Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
45brrQrxwH.exe

Overview

General Information

Sample name:45brrQrxwH.exe
renamed because original name is a hash value
Original sample name:cfaf6fedf4a8954df63b75e1574e66b3.exe
Analysis ID:1427156
MD5:cfaf6fedf4a8954df63b75e1574e66b3
SHA1:dc5d8ed078cf6225e133c228670edac311af28b2
SHA256:64c3f8bf923b9869c7b0f2a77eb1b1db64eae1caec23fa0da3da85c2c885b139
Tags:32exetrojan
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 45brrQrxwH.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\45brrQrxwH.exe" MD5: CFAF6FEDF4A8954DF63B75E1574E66B3)
    • powershell.exe (PID: 7616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 7680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 8024 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • schtasks.exe (PID: 7756 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 45brrQrxwH.exe (PID: 7876 cmdline: "C:\Users\user\Desktop\45brrQrxwH.exe" MD5: CFAF6FEDF4A8954DF63B75E1574E66B3)
    • 45brrQrxwH.exe (PID: 7892 cmdline: "C:\Users\user\Desktop\45brrQrxwH.exe" MD5: CFAF6FEDF4A8954DF63B75E1574E66B3)
  • XEWKUH.exe (PID: 8160 cmdline: C:\Users\user\AppData\Roaming\XEWKUH.exe MD5: CFAF6FEDF4A8954DF63B75E1574E66B3)
    • schtasks.exe (PID: 7216 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • XEWKUH.exe (PID: 5996 cmdline: "C:\Users\user\AppData\Roaming\XEWKUH.exe" MD5: CFAF6FEDF4A8954DF63B75E1574E66B3)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "viorel5000@yandex.ru", "Password": "fknhxyuavrcsphhd"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 17 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.45brrQrxwH.exe.49a9810.7.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              0.2.45brrQrxwH.exe.49a9810.7.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.45brrQrxwH.exe.49a9810.7.unpackINDICATOR_SUSPICIOUS_EXE_VaultSchemaGUIDDetects executables referencing Windows vault credential objects. Observed in infostealersditekSHen
                • 0x330b5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
                • 0x33127:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55
                • 0x331b1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F
                • 0x33243:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
                • 0x332ad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
                • 0x3331f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
                • 0x333b5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
                • 0x33445:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
                0.2.45brrQrxwH.exe.496d1f0.8.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                  0.2.45brrQrxwH.exe.496d1f0.8.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    Click to see the 22 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\45brrQrxwH.exe", ParentImage: C:\Users\user\Desktop\45brrQrxwH.exe, ParentProcessId: 7432, ParentProcessName: 45brrQrxwH.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", ProcessId: 7616, ProcessName: powershell.exe
                    Sigma detected: Powershell Defender Exclusion
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\45brrQrxwH.exe", ParentImage: C:\Users\user\Desktop\45brrQrxwH.exe, ParentProcessId: 7432, ParentProcessName: 45brrQrxwH.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", ProcessId: 7616, ProcessName: powershell.exe
                    Sigma detected: Suspicious Add Scheduled Task Parent
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\XEWKUH.exe, ParentImage: C:\Users\user\AppData\Roaming\XEWKUH.exe, ParentProcessId: 8160, ParentProcessName: XEWKUH.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp", ProcessId: 7216, ProcessName: schtasks.exe
                    Sigma detected: Suspicious Outbound SMTP Connections
                    Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\45brrQrxwH.exe, Initiated: true, ProcessId: 7892, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737
                    Sigma detected: Suspicious Schtasks From Env Var Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\45brrQrxwH.exe", ParentImage: C:\Users\user\Desktop\45brrQrxwH.exe, ParentProcessId: 7432, ParentProcessName: 45brrQrxwH.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", ProcessId: 7756, ProcessName: schtasks.exe
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\45brrQrxwH.exe", ParentImage: C:\Users\user\Desktop\45brrQrxwH.exe, ParentProcessId: 7432, ParentProcessName: 45brrQrxwH.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe", ProcessId: 7616, ProcessName: powershell.exe

                    Persistence and Installation Behavior

                    barindex
                    Sigma detected: Scheduled temp file as task from temp location
                    Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\45brrQrxwH.exe", ParentImage: C:\Users\user\Desktop\45brrQrxwH.exe, ParentProcessId: 7432, ParentProcessName: 45brrQrxwH.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp", ProcessId: 7756, ProcessName: schtasks.exe

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: 45brrQrxwH.exeAvira: detected
                    Antivirus detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeAvira: detection malicious, Label: TR/AD.GenSteal.kgogp
                    Found malware configuration
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "viorel5000@yandex.ru", "Password": "fknhxyuavrcsphhd"}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeReversingLabs: Detection: 68%
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeVirustotal: Detection: 70%Perma Link
                    Multi AV Scanner detection for submitted file
                    Source: 45brrQrxwH.exeReversingLabs: Detection: 68%
                    Source: 45brrQrxwH.exeVirustotal: Detection: 69%Perma Link
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeJoe Sandbox ML: detected
                    Machine Learning detection for sample
                    Source: 45brrQrxwH.exeJoe Sandbox ML: detected
                    Source: 45brrQrxwH.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: unknownHTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49735 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49739 version: TLS 1.2
                    Source: 45brrQrxwH.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: GrPo.pdbSHA256 source: 45brrQrxwH.exe, XEWKUH.exe.0.dr
                    Source: Binary string: GrPo.pdb source: 45brrQrxwH.exe, XEWKUH.exe.0.dr
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 4x nop then jmp 0CB3AC99h0_2_0CB3AECB
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 4x nop then jmp 07469F41h11_2_0746A173
                    Source: global trafficTCP traffic: 192.168.2.4:49737 -> 77.88.21.158:587
                    Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
                    Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
                    Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
                    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                    Source: unknownDNS query: name: api.ipify.org
                    Source: unknownDNS query: name: api.ipify.org
                    Source: unknownDNS query: name: api.ipify.org
                    Source: global trafficTCP traffic: 192.168.2.4:49737 -> 77.88.21.158:587
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: unknownDNS traffic detected: queries for: api.ipify.org
                    Source: 45brrQrxwH.exe, XEWKUH.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                    Source: 45brrQrxwH.exe, XEWKUH.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
                    Source: XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.glob
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891722056.0000000006560000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root.crl0G
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.0000000001277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.mic
                    Source: 45brrQrxwH.exe, XEWKUH.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/rootr103
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891722056.0000000006560000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
                    Source: 45brrQrxwH.exe, 00000000.00000002.1676007009.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1715474200.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
                    Source: 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://smtp.yandex.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682481464.0000000005CB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com-u
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                    Source: 45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                    Source: 45brrQrxwH.exe, 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://account.dyn.com/
                    Source: 45brrQrxwH.exe, 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
                    Source: 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                    Source: 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/t
                    Source: 45brrQrxwH.exe, XEWKUH.exe.0.drString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065F7000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891722056.0000000006560000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2891881314.00000000065AC000.00000004.00000020.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2872028506.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2893047901.0000000006A25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
                    Source: unknownHTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49735 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49739 version: TLS 1.2

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Contains functionality to log keystrokes (.Net Source)
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, K6raBsUk6.cs.Net Code: dY0HHDevtD

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.45brrQrxwH.exe.496d1f0.8.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 14.2.XEWKUH.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 11.2.XEWKUH.exe.3d62190.6.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 11.2.XEWKUH.exe.3d9e7b0.4.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 11.2.XEWKUH.exe.3d9e7b0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.45brrQrxwH.exe.496d1f0.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 11.2.XEWKUH.exe.3d62190.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    .NET source code contains very large array initializations
                    Source: 0.2.45brrQrxwH.exe.7460000.12.raw.unpack, -Module-.csLarge array initialization: _206A_200E_202E_206C_206B_206B_202B_206A_206B_200C_202D_200E_206D_200C_200E_206E_206D_202C_202C_200C_206A_206F_200B_206D_202E_206A_200E_206F_200E_202B_206B_202A_202B_206D_206D_202A_206B_200B_202C_200E_202E: array initializer size 2976
                    Source: 0.2.45brrQrxwH.exe.2c46998.0.raw.unpack, -Module-.csLarge array initialization: _206A_200E_202E_206C_206B_206B_202B_206A_206B_200C_202D_200E_206D_200C_200E_206E_206D_202C_202C_200C_206A_206F_200B_206D_202E_206A_200E_206F_200E_202B_206B_202A_202B_206D_206D_202A_206B_200B_202C_200E_202E: array initializer size 2976
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_012AFC180_2_012AFC18
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_012AFC090_2_012AFC09
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_012ADCD40_2_012ADCD4
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB318B80_2_0CB318B8
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB3AB880_2_0CB3AB88
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB3C7E00_2_0CB3C7E0
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB34D300_2_0CB34D30
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB318AB0_2_0CB318AB
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB348F80_2_0CB348F8
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB348E80_2_0CB348E8
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB368100_2_0CB36810
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB368000_2_0CB36800
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB344C00_2_0CB344C0
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB380490_2_0CB38049
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB3117B0_2_0CB3117B
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_0CB363D80_2_0CB363D8
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013AA1AA9_2_013AA1AA
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013A41C89_2_013A41C8
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013AE67F9_2_013AE67F
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013AAA3A9_2_013AAA3A
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013A4A989_2_013A4A98
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013A3E809_2_013A3E80
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C165D09_2_06C165D0
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C17D589_2_06C17D58
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C155789_2_06C15578
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C1B20A9_2_06C1B20A
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C130409_2_06C13040
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C176789_2_06C17678
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C15CC79_2_06C15CC7
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C1E3809_2_06C1E380
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C100409_2_06C10040
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_06C100079_2_06C10007
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_02B0FC1811_2_02B0FC18
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_02B0DCD411_2_02B0DCD4
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_02B0FC0911_2_02B0FC09
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_07469E3211_2_07469E32
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_0746B9D011_2_0746B9D0
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_074618B811_2_074618B8
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_074644C011_2_074644C0
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_074663D811_2_074663D8
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_07464D3011_2_07464D30
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_0746680011_2_07466800
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_0746681011_2_07466810
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_074648F811_2_074648F8
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_074618AA11_2_074618AA
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EF41C814_2_02EF41C8
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EF4A9814_2_02EF4A98
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EFE81114_2_02EFE811
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EF3E8014_2_02EF3E80
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EFA98014_2_02EFA980
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C565D014_2_06C565D0
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C57D5814_2_06C57D58
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5557814_2_06C55578
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5B20A14_2_06C5B20A
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5304014_2_06C53040
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5767814_2_06C57678
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C55CC714_2_06C55CC7
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5E38014_2_06C5E380
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5004014_2_06C50040
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_06C5000614_2_06C50006
                    Source: 45brrQrxwH.exeStatic PE information: invalid certificate
                    Source: 45brrQrxwH.exe, 00000000.00000000.1618818899.0000000000912000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameGrPo.exeF vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameb02e2ec5-9746-46a0-b9cb-1759d306bdf4.exe4 vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1671993163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1678240025.00000000045FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1685312412.000000000CE10000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000000.00000002.1676007009.0000000002F1B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameb02e2ec5-9746-46a0-b9cb-1759d306bdf4.exe4 vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exe, 00000009.00000002.2871786317.0000000000DB9000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exeBinary or memory string: OriginalFilenameGrPo.exeF vs 45brrQrxwH.exe
                    Source: 45brrQrxwH.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.45brrQrxwH.exe.496d1f0.8.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 14.2.XEWKUH.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 11.2.XEWKUH.exe.3d62190.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 11.2.XEWKUH.exe.3d9e7b0.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 11.2.XEWKUH.exe.3d9e7b0.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.45brrQrxwH.exe.496d1f0.8.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 11.2.XEWKUH.exe.3d62190.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 45brrQrxwH.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: XEWKUH.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, c2bZQnG.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, c2bZQnG.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, Q1L0K.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, Q1L0K.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, uo1UBaEHa.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, uo1UBaEHa.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, uo1UBaEHa.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, uo1UBaEHa.csCryptographic APIs: 'TransformFinalBlock'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, riNAXZ6HF1cuNjfj0y.csSecurity API names: _0020.SetAccessControl
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, riNAXZ6HF1cuNjfj0y.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, riNAXZ6HF1cuNjfj0y.csSecurity API names: _0020.AddAccessRule
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, yPVL7dgAKrCaiOSvIX.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.45brrQrxwH.exe.2c85560.3.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
                    Source: 0.2.45brrQrxwH.exe.ca90000.13.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
                    Source: 0.2.45brrQrxwH.exe.2c66388.2.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@21/15@2/2
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile created: C:\Users\user\AppData\Roaming\XEWKUH.exeJump to behavior
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7228:120:WilError_03
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMutant created: \Sessions\1\BaseNamedObjects\hXBUVzt
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile created: C:\Users\user\AppData\Local\Temp\tmp365A.tmpJump to behavior
                    Source: 45brrQrxwH.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 45brrQrxwH.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: 45brrQrxwH.exeReversingLabs: Detection: 68%
                    Source: 45brrQrxwH.exeVirustotal: Detection: 69%
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile read: C:\Users\user\Desktop\45brrQrxwH.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp"
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\XEWKUH.exe C:\Users\user\AppData\Roaming\XEWKUH.exe
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp"
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Users\user\AppData\Roaming\XEWKUH.exe "C:\Users\user\AppData\Roaming\XEWKUH.exe"
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Users\user\AppData\Roaming\XEWKUH.exe "C:\Users\user\AppData\Roaming\XEWKUH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: vaultcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: uxtheme.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: wldp.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: amsi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: userenv.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rasapi32.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rasman.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rtutils.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: mswsock.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: winhttp.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: dhcpcsvc6.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: dhcpcsvc.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: dnsapi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: winnsi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: rasadhlp.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: fwpuclnt.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: secur32.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: schannel.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: mskeyprotect.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ntasn1.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ncrypt.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: ncryptsslp.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: gpapi.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: vaultcli.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: wintypes.dll
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeSection loaded: dpapi.dll
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\ProfilesJump to behavior
                    Source: 45brrQrxwH.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: 45brrQrxwH.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: 45brrQrxwH.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                    Source: Binary string: GrPo.pdbSHA256 source: 45brrQrxwH.exe, XEWKUH.exe.0.dr
                    Source: Binary string: GrPo.pdb source: 45brrQrxwH.exe, XEWKUH.exe.0.dr

                    Data Obfuscation

                    barindex
                    .NET source code contains potential unpacker
                    Source: 45brrQrxwH.exe, Form1.cs.Net Code: InitializeComponent
                    Source: XEWKUH.exe.0.dr, Form1.cs.Net Code: InitializeComponent
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, riNAXZ6HF1cuNjfj0y.cs.Net Code: pCutViC4ZA System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.45brrQrxwH.exe.7460000.12.raw.unpack, -Module-.cs.Net Code: _206A_200E_202E_206C_206B_206B_202B_206A_206B_200C_202D_200E_206D_200C_200E_206E_206D_202C_202C_200C_206A_206F_200B_206D_202E_206A_200E_206F_200E_202B_206B_202A_202B_206D_206D_202A_206B_200B_202C_200E_202E System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.45brrQrxwH.exe.7460000.12.raw.unpack, Dill.cs.Net Code: Justy
                    Source: 0.2.45brrQrxwH.exe.7460000.12.raw.unpack, Dill.cs.Net Code: _200C_202B_202A_200B_200F_202E_202D_202A_206F_202A_202A_206D_202D_200F_202E_206C_206C_200B_202B_200E_202B_200E_200C_200C_206F_202E_202D_200F_202E_202B_200E_206C_202A_202D_202A_206E_202B_206A_200C_200F_202E System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.45brrQrxwH.exe.2c46998.0.raw.unpack, -Module-.cs.Net Code: _206A_200E_202E_206C_206B_206B_202B_206A_206B_200C_202D_200E_206D_200C_200E_206E_206D_202C_202C_200C_206A_206F_200B_206D_202E_206A_200E_206F_200E_202B_206B_202A_202B_206D_206D_202A_206B_200B_202C_200E_202E System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.45brrQrxwH.exe.2c46998.0.raw.unpack, Dill.cs.Net Code: Justy
                    Source: 0.2.45brrQrxwH.exe.2c46998.0.raw.unpack, Dill.cs.Net Code: _200C_202B_202A_200B_200F_202E_202D_202A_206F_202A_202A_206D_202D_200F_202E_206C_206C_200B_202B_200E_202B_200E_200C_200C_206F_202E_202D_200F_202E_202B_200E_206C_202A_202D_202A_206E_202B_206A_200C_200F_202E System.Reflection.Assembly.Load(byte[])
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 0_2_012AF1D0 push esp; iretd 0_2_012AF1D1
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013A0C3D push edi; ret 9_2_013A0CC2
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeCode function: 9_2_013A0C95 push edi; retf 9_2_013A0C3A
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 11_2_02B0F1D0 push esp; iretd 11_2_02B0F1D1
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EFA518 push eax; retf 14_2_02EFA6D9
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EF0C95 push edi; retf 14_2_02EF0C3A
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeCode function: 14_2_02EF0C3D push edi; ret 14_2_02EF0CC2
                    Source: 45brrQrxwH.exeStatic PE information: section name: .text entropy: 7.989229462300673
                    Source: XEWKUH.exe.0.drStatic PE information: section name: .text entropy: 7.989229462300673
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, qT3LKKY12RyaEsFwCQ.csHigh entropy of concatenated method names: 'rgMDQY8NsD', 'EDEDn8UAyR', 'KMsBqSZfbf', 'LhGBjSgZOL', 'wJJDiofuf8', 'mk1DZs5Z7J', 'FIJDE5EpJx', 'dx6DdSrcZp', 'QF7DoCFJxm', 'daMDvv7NKF'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, FrqrXuntsRY4dQ12m3.csHigh entropy of concatenated method names: 'ob4kjykZ5O', 'I7ikGDo2EA', 'm9KktriXEi', 'PXBkXW61XP', 'EkxkpCDnSp', 'iO9k2l9t2n', 'JIsk3dMvaR', 'k8yBOfZ25Y', 'M4YBQtNs7Z', 'R4ZBsRauKf'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, r9uiNR592kIU8jstUu.csHigh entropy of concatenated method names: 'OeJJXVVkRM', 'd0dJAtVWxf', 'JNLJ3Pw3hs', 'Les3nu8dTx', 'dRs3zjnOAM', 'Cq5JquivCT', 'WlLJjoTu1c', 'FbHJ7tPmjy', 'kcOJG22iB2', 'uPqJt26D4a'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, zvrtm7dQhHRB5nuN5A.csHigh entropy of concatenated method names: 'z8NU4sS22E', 'SMpUZoj8gX', 'xodUdV4wpE', 'QnyUoK9VIP', 'xJRUKtdMyf', 'BrJUwCOMxv', 'cmZUcLZoMa', 'R5SUWxjefm', 'GSkURSWeH5', 'oLUU5ihob2'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, jblDDrjG64QnQWFhj1x.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'G9N8de7Hvv', 'xoQ8oBj3Be', 'OtT8vt907c', 'PhH8rr57ik', 'HcF8CLs6cV', 'sRR8YDM6AS', 'gqD8OBIfl0'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, CiHXoLHpM6OChBDZwg.csHigh entropy of concatenated method names: 'mZX31rhmsX', 'dpS3pSqrAG', 'Orl32HTDp6', 'yLc3JnbXKq', 'S1n36nxsap', 'cxa2CphKqs', 'N1K2YN38pE', 'kDX2OBMOIt', 'Vb12QeEime', 'sLf2saINeu'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, kom4uK7RDLsv0gMB33.csHigh entropy of concatenated method names: 'C6yVeVuTU', 'ceGbHG0fm', 'mQ1hAmAjp', 'Nd9yZUnjE', 'wSWuI73mM', 'f67TGuuwt', 'fBkytDD3fuDVBfuNFN', 'LXSXWr7M7SIkSFglt2', 'QROB2OeVW', 'dqg84xl77'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, Jhesgp9D5oI16DZtfW.csHigh entropy of concatenated method names: 'R1SJNbwAHx', 'lwoJelnlA4', 's7MJVqySuZ', 'IkpJbcSJN1', 'rhMJfLfBFQ', 'ronJhDDBa7', 'iEoJyg5JcN', 'HuFJgvTcoO', 'jxbJuyEHYP', 'FFJJTwPmn7'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, HeM0FJKgQhnrdHrB3b.csHigh entropy of concatenated method names: 'sFGb1c1SXclmjg0KRDx', 'POLGsY1Ax9vwr2qBm0u', 'a393BMaqfW', 'egH3k8VW0G', 'xOE38OrSIj', 'WCPLxU1E5n1ljZQvcoF', 'f1dO681vtSflvb7VQF2'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, yaZic2T9SZ4uucIGZ0.csHigh entropy of concatenated method names: 'VMf2flaBu4', 'XEC2ytEI76', 'cylAwaXqtN', 'MebAcoo8A4', 'LskAWDGI8Y', 'q5YARrJ7kI', 'dnxA52tZjP', 'dNaAI0F4I8', 'Kn4A9tYtNZ', 'AiAA4wAsc4'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, riNAXZ6HF1cuNjfj0y.csHigh entropy of concatenated method names: 'eHsG1E63wj', 'TvNGXXAcgP', 'zuIGp9GkmT', 'APtGAEUN8B', 'dkNG2a15Ri', 'MJCG3ccPhh', 'O4hGJ5Eiyo', 'kTwG6xP1Ln', 'IpcGmaxLtD', 'pK0G0196PM'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, sTQKbZEmg7O4w4HHge.csHigh entropy of concatenated method names: 'IchxgDIyUR', 'xD9xuqFqu6', 'mdVxHWVkPL', 'dmSxK7LneS', 'Pxvxcuwfow', 't79xWels4t', 'wnPx5QQJpV', 'daMxIZuHcj', 'TFAx4bju8g', 'r1oxiMZMA7'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, ta9mSRQsG1OWUofc1C.csHigh entropy of concatenated method names: 'WPVBXvsc74', 'ihlBpoRthF', 'fmeBAb4J68', 'GT4B2AUn5S', 'tg4B34NIpv', 'WIbBJscVwa', 'zJhB6mA9Fx', 'sQkBmThV6V', 'XsnB0f0tpw', 'KOLBL70dty'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, cnrwLjtT72mgvPT8Px.csHigh entropy of concatenated method names: 'JeejJPVL7d', 'hKrj6CaiOS', 'kX3j01vDt1', 'BZjjLReaZi', 'IIGjUZ0hiH', 'foLjSpM6OC', 'eZUmMCmYP5M3sKlpYb', 'AohLhwWyTAnWm1ExL9', 'yW2jjgNtOs', 'dNdjGkXONP'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, zDsIOopUytTPMLukrI.csHigh entropy of concatenated method names: 'Dispose', 'k0fjsDkVTA', 'Gnt7Kr2rER', 'uJCoocSYRP', 'DMajn9mSRs', 'c1OjzWUofc', 'ProcessDialogKey', 'eCF7qdLaP4', 'znO7jTR5Cw', 'VG077TrqrX'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, yPVL7dgAKrCaiOSvIX.csHigh entropy of concatenated method names: 'UXFpdyhN85', 'hIYpo7gm2P', 'IGKpvu2nAq', 'KnXprjfwJY', 'Gx2pC0eXCt', 'VSxpYDmdPY', 'RdfpOldiRv', 'moDpQsILqJ', 'OKCpsGIVXd', 'RQFpnF8QG5'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, udLaP4senOTR5CwYG0.csHigh entropy of concatenated method names: 'oLIBHvrMK1', 'QOvBKrPwyP', 'AsFBwjnxtL', 'FrRBc8fFKn', 'po7BdyTorn', 'slYBW6qNCP', 'Next', 'Next', 'Next', 'NextBytes'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, sme82evSWIDqGFNKs9.csHigh entropy of concatenated method names: 'ToString', 'lr8SilOZVh', 'wbRSKcIFqC', 'UbUSwall1O', 'EkMScJKXHo', 'qCjSWAKU1F', 'hthSRvLj69', 'lssS5bPrLZ', 'wf8SIRv1C3', 'AsDS9neIS2'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, NcbY96uX31vDt1hZjR.csHigh entropy of concatenated method names: 'oQVAbieoIj', 'UsBAh1UOci', 'zf1AgUVol7', 'YECAucm2pu', 'msgAU7m0wB', 'rUvASU9q8E', 'DmyAD2X3Zo', 'XPdABoXoH3', 'StYAkEaD6v', 'cMUA81UWTx'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, V3KwlAjqK6huwGZedNF.csHigh entropy of concatenated method names: 'yNokNGakmF', 'pH7ke7oKYj', 'TqmkV4Kmvr', 'RqnkbX38AK', 'E3jkfww971', 'EnokhKWKGU', 'vNNky2y5Sa', 'gXJkgYFRTj', 'c8fkuTfLju', 'IaokTtba0r'
                    Source: 0.2.45brrQrxwH.exe.ce10000.14.raw.unpack, C22dikztXFeTmP6Oyu.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LDnkxJNPU5', 'uIekURhIEd', 'yxikScph46', 'Xa9kDytuW4', 'VPBkBb8vCM', 'OTnkkiZ3BW', 'Kbuk8IFm68'
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile created: C:\Users\user\AppData\Roaming\XEWKUH.exeJump to dropped file

                    Boot Survival

                    barindex
                    Uses schtasks.exe or at.exe to add and modify task schedules
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp"

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Loading BitLocker PowerShell Module
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7432, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 8160, type: MEMORYSTR
                    Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 12A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 2C20000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 4C20000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 75C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 85C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 8760000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 9760000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 9A90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: AA90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: BA90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: CE90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: DE90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: EE90000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: F4E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 13A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 2FE0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: 1600000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 2AC0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 2CD0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 2B20000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 73E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 70D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 83E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 93E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 96F0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: A6F0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 7720000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 96F0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: A6F0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 2EB0000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 2F10000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory allocated: 4F10000 memory reserve | memory write watch
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7182Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 819Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8546Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1077Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWindow / User API: threadDelayed 4446Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWindow / User API: threadDelayed 5403Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWindow / User API: threadDelayed 6856
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWindow / User API: threadDelayed 2993
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 7452Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7900Thread sleep time: -7378697629483816s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7812Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7932Thread sleep time: -6456360425798339s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -26747778906878833s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -100000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8152Thread sleep count: 4446 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99844s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8152Thread sleep count: 5403 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99719s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99609s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99500s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99391s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99281s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99172s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -198124s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98952s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98844s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98719s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98609s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98491s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98375s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98266s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98146s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98016s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97906s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97788s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97672s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97433s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97314s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97188s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -97078s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96969s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96859s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96750s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96641s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96531s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96422s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96313s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96188s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -96063s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -95938s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99984s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99875s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99765s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99656s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99547s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99437s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -99303s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98953s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98843s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98734s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98625s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exe TID: 8136Thread sleep time: -98515s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 8180Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep count: 37 > 30
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -34126476536362649s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -100000s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7252Thread sleep count: 6856 > 30
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99890s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7252Thread sleep count: 2993 > 30
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99781s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99671s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99562s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99453s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99343s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99234s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99125s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99015s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98906s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98796s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98680s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98568s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98437s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98328s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98187s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98078s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97968s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97859s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97749s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97640s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97531s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97421s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97312s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97203s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -97093s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96984s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96874s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96765s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96655s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96544s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96437s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -96328s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99999s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99891s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99766s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99657s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99532s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99407s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99297s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99187s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -99078s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98969s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98860s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98735s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98610s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98485s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98358s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exe TID: 7244Thread sleep time: -98223s >= -30000s
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 100000Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99844Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99719Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99609Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99500Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99391Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99281Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99172Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99062Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98952Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98844Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98719Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98609Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98491Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98375Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98266Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98146Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98016Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97906Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97788Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97672Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97547Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97433Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97314Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97188Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 97078Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96969Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96859Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96750Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96641Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96531Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96422Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96313Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96188Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 96063Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 95938Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99984Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99875Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99765Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99656Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99547Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99437Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 99303Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98953Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98843Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98734Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98625Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeThread delayed: delay time: 98515Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 100000
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99890
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99781
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99671
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99562
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99453
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99343
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99234
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99125
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99015
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98906
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98796
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98680
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98568
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98437
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98328
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98187
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98078
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97968
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97859
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97749
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97640
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97531
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97421
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97312
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97203
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 97093
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96984
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96874
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96765
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96655
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96544
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96437
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 96328
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99999
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99891
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99766
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99657
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99532
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99407
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99297
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99187
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 99078
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98969
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98860
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98735
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98610
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98485
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98358
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeThread delayed: delay time: 98223
                    Source: 45brrQrxwH.exe, 00000009.00000002.2873182692.00000000012DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB12
                    Source: XEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"Jump to behavior
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeMemory written: C:\Users\user\Desktop\45brrQrxwH.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeMemory written: C:\Users\user\AppData\Roaming\XEWKUH.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeProcess created: C:\Users\user\Desktop\45brrQrxwH.exe "C:\Users\user\Desktop\45brrQrxwH.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeProcess created: C:\Users\user\AppData\Roaming\XEWKUH.exe "C:\Users\user\AppData\Roaming\XEWKUH.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Users\user\Desktop\45brrQrxwH.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Users\user\Desktop\45brrQrxwH.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Users\user\AppData\Roaming\XEWKUH.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Users\user\AppData\Roaming\XEWKUH.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.XEWKUH.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2876066217.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7432, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7892, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 8160, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 5996, type: MEMORYSTR
                    Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
                    Tries to steal Mail credentials (via file / registry access)
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                    Source: C:\Users\user\Desktop\45brrQrxwH.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                    Source: C:\Users\user\AppData\Roaming\XEWKUH.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.XEWKUH.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2876066217.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7432, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7892, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 8160, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 5996, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.XEWKUH.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.49a9810.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d9e7b0.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.45brrQrxwH.exe.496d1f0.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.XEWKUH.exe.3d62190.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2876066217.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7432, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 45brrQrxwH.exe PID: 7892, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 8160, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: XEWKUH.exe PID: 5996, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts121
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		11
                    Disable or Modify Tools                    		1
                    OS Credential Dumping                    		1
                    File and Directory Discovery                    		Remote Services11
                    Archive Collected Data                    		1
                    Ingress Tool Transfer                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job                    		1
                    Scheduled Task/Job                    		111
                    Process Injection                    		1
                    Deobfuscate/Decode Files or Information                    		1
                    Input Capture                    		24
                    System Information Discovery                    		Remote Desktop Protocol1
                    Data from Local System                    		11
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                    Scheduled Task/Job                    		3
                    Obfuscated Files or Information                    		1
                    Credentials in Registry                    		1
                    Query Registry                    		SMB/Windows Admin Shares1
                    Email Collection                    		1
                    Non-Standard Port                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook12
                    Software Packing                    		NTDS211
                    Security Software Discovery                    		Distributed Component Object Model1
                    Input Capture                    		2
                    Non-Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    DLL Side-Loading                    		LSA Secrets1
                    Process Discovery                    		SSHKeylogging23
                    Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    Masquerading                    		Cached Domain Credentials141
                    Virtualization/Sandbox Evasion                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items141
                    Virtualization/Sandbox Evasion                    		DCSync1
                    Application Window Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
                    Process Injection                    		Proc Filesystem1
                    System Network Configuration Discovery                    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1427156 Sample: 45brrQrxwH.exe Startdate: 17/04/2024 Architecture: WINDOWS Score: 100 42 smtp.yandex.ru 2->42 44 smtp.yandex.com 2->44 46 api.ipify.org 2->46 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 9 other signatures 2->58 8 45brrQrxwH.exe 7 2->8         started        12 XEWKUH.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\Roaming\XEWKUH.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\tmp365A.tmp, XML 8->40 dropped 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 8->62 64 Adds a directory exclusion to Windows Defender 8->64 66 Injects a PE file into a foreign processes 8->66 14 45brrQrxwH.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        26 2 other processes 8->26 68 Antivirus detection for dropped file 12->68 70 Multi AV Scanner detection for dropped file 12->70 72 Machine Learning detection for dropped file 12->72 22 XEWKUH.exe 12->22         started        24 schtasks.exe 12->24         started        signatures6 process7 dnsIp8 48 smtp.yandex.ru 77.88.21.158, 49737, 49740, 49741 YANDEXRU Russian Federation 14->48 50 api.ipify.org 172.67.74.152, 443, 49735, 49739 CLOUDFLARENETUS United States 14->50 74 Loading BitLocker PowerShell Module 18->74 28 WmiPrvSE.exe 18->28         started        30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        76 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->76 78 Tries to steal Mail credentials (via file / registry access) 22->78 80 Tries to harvest and steal browser information (history, passwords, etc) 22->80 34 conhost.exe 24->34         started        36 conhost.exe 26->36         started        signatures9 process10

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    45brrQrxwH.exe68%ReversingLabsByteCode-MSIL.Spyware.Negasteal
                    45brrQrxwH.exe69%VirustotalBrowse
                    45brrQrxwH.exe100%AviraTR/AD.GenSteal.kgogp
                    45brrQrxwH.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Roaming\XEWKUH.exe100%AviraTR/AD.GenSteal.kgogp
                    C:\Users\user\AppData\Roaming\XEWKUH.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Roaming\XEWKUH.exe68%ReversingLabsByteCode-MSIL.Spyware.Negasteal
                    C:\Users\user\AppData\Roaming\XEWKUH.exe70%VirustotalBrowse

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://www.tiro.com0%URL Reputationsafe
                    http://www.goodfont.co.kr0%URL Reputationsafe
                    https://www.chiark.greenend.org.uk/~sgtatham/putty/00%URL Reputationsafe
                    http://go.mic0%URL Reputationsafe
                    http://www.carterandcone.coml0%URL Reputationsafe
                    http://www.sajatypeworks.com0%URL Reputationsafe
                    http://www.typography.netD0%URL Reputationsafe
                    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                    http://www.sandoll.co.kr0%URL Reputationsafe
                    http://www.urwpp.deDPlease0%URL Reputationsafe
                    http://www.sakkal.com0%URL Reputationsafe
                    http://www.founder.com.cn/cn/cThe0%VirustotalBrowse
                    http://www.zhongyicts.com.cn1%VirustotalBrowse
                    http://www.founder.com.cn/cn/bThe0%VirustotalBrowse
                    http://www.founder.com.cn/cn0%VirustotalBrowse

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    smtp.yandex.ru
                    		77.88.21.158
                    		truefalse
                      		high
                      api.ipify.org
                      		172.67.74.152
                      		truefalse
                        		high
                        smtp.yandex.com
                        		unknown
                        		unknownfalse
                          		high

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://api.ipify.org/false
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://www.apache.org/licenses/LICENSE-2.045brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.fontbureau.com45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.fontbureau.com/designersG45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.fontbureau.com/designers/?45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cn/bThe45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                    https://account.dyn.com/45brrQrxwH.exe, 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designers?45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://crl.globXEWKUH.exe, 0000000E.00000002.2872028506.000000000114C000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://www.tiro.com45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.com/designers45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.goodfont.co.kr45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://api.ipify.org/t45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.chiark.greenend.org.uk/~sgtatham/putty/045brrQrxwH.exe, XEWKUH.exe.0.drfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://go.mic45brrQrxwH.exe, 00000009.00000002.2873182692.0000000001277000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://smtp.yandex.com45brrQrxwH.exe, 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000003114000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000003044000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.carterandcone.coml45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.sajatypeworks.com45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.typography.netD45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.com/designers/cabarga.htmlN45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.founder.com.cn/cn/cThe45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                                  http://www.galapagosdesign.com/staff/dennis.htm45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://api.ipify.org45brrQrxwH.exe, 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.founder.com.cn/cn45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                                    http://www.fontbureau.com/designers/frere-user.html45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.sakkal.com-u45brrQrxwH.exe, 00000000.00000002.1682481464.0000000005CB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.galapagosdesign.com/DPlease45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers845brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.fonts.com45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.sandoll.co.kr45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.urwpp.deDPlease45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.zhongyicts.com.cn45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name45brrQrxwH.exe, 00000000.00000002.1676007009.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp, 45brrQrxwH.exe, 00000009.00000002.2876066217.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000B.00000002.1715474200.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, XEWKUH.exe, 0000000E.00000002.2875685208.0000000002F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.sakkal.com45brrQrxwH.exe, 00000000.00000002.1682521586.0000000006D82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown

                                                              World Map of Contacted IPs

                                                              • No. of IPs < 25%
                                                              • 25% < No. of IPs < 50%
                                                              • 50% < No. of IPs < 75%
                                                              • 75% < No. of IPs

                                                              Public IPs

                                                              IPDomainCountryFlagASNASN NameMalicious
                                                              77.88.21.158
                                                              		smtp.yandex.ruRussian Federation
                                                              		13238YANDEXRUfalse
                                                              172.67.74.152
                                                              		api.ipify.orgUnited States
                                                              		13335CLOUDFLARENETUSfalse

                                                              General Information

                                                              Joe Sandbox version:40.0.0 Tourmaline
                                                              Analysis ID:1427156
                                                              Start date and time:2024-04-17 06:23:05 +02:00
                                                              Joe Sandbox product:CloudBasic
                                                              Overall analysis duration:0h 8m 15s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:full
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                              Number of analysed new started processes analysed:19
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:0
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Sample name:45brrQrxwH.exe
                                                              renamed because original name is a hash value
                                                              Original Sample Name:cfaf6fedf4a8954df63b75e1574e66b3.exe
                                                              Detection:MAL
                                                              Classification:mal100.troj.spyw.evad.winEXE@21/15@2/2
                                                              EGA Information:
                                                              • Successful, ratio: 100%
                                                              HCA Information:
                                                              • Successful, ratio: 99%
                                                              • Number of executed functions: 172
                                                              • Number of non-executed functions: 20
                                                              Cookbook Comments:
                                                              • Found application associated with file extension: .exe

                                                              Warnings

                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                              • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                              • Not all processes where analyzed, report is missing behavior information
                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              05:23:56Task SchedulerRun new task: XEWKUH path: C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                              06:23:51API Interceptor73x Sleep call for process: 45brrQrxwH.exe modified
                                                              06:23:54API Interceptor38x Sleep call for process: powershell.exe modified
                                                              06:23:57API Interceptor68x Sleep call for process: XEWKUH.exe modified

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              77.88.21.158Order_ OFI-MAR-2024-000019_ Valve pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                PO No.109480 Dt.18Mar2024 pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                  https://cdn.discordapp.com/attachments/1219079930122338327/1219193029647274034/PO_No.109480_Dt.18Mar2024_pdf.7z?ex=660a68fd&is=65f7f3fd&hm=c1267cdec3cb72a30ed3524db2c95f7e2274d988486fe24145ef7f3d03bd1e0b&Get hashmaliciousAgentTeslaBrowse
                                                                    TT_payment_swift_copy_#11-03-2024.exeGet hashmaliciousAgentTeslaBrowse
                                                                      SecuriteInfo.com.BackDoor.SpyBotNET.75.7639.3836.exeGet hashmaliciousAgentTeslaBrowse
                                                                        18uCIUfRfU.exeGet hashmaliciousAgentTeslaBrowse
                                                                          sZ3v675Idu.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                            NUEVA_PO_AC71189.docGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                              SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.22690.19845.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                jdc9ITsf3v.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  172.67.74.152Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  Sky-Beta-Setup.exeGet hashmaliciousStealitBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  Sky-Beta.exeGet hashmaliciousStealitBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  SongOfVikings.exeGet hashmaliciousUnknownBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  SongOfVikings.exeGet hashmaliciousUnknownBrowse
                                                                                  • api.ipify.org/?format=json
                                                                                  Sky-Beta Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                  • api.ipify.org/?format=json

                                                                                  Domains

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  smtp.yandex.ruRFQ.docGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  Order_ OFI-MAR-2024-000019_ Valve pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  PO No.109480 Dt.18Mar2024 pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  https://cdn.discordapp.com/attachments/1219079930122338327/1219193029647274034/PO_No.109480_Dt.18Mar2024_pdf.7z?ex=660a68fd&is=65f7f3fd&hm=c1267cdec3cb72a30ed3524db2c95f7e2274d988486fe24145ef7f3d03bd1e0b&Get hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  TT_payment_swift_copy_#11-03-2024.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  PO-45728-10876.docGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  SecuriteInfo.com.BackDoor.SpyBotNET.75.7639.3836.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  18uCIUfRfU.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 77.88.21.158
                                                                                  sZ3v675Idu.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                  • 77.88.21.158
                                                                                  NUEVA_PO_AC71189.docGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                  • 77.88.21.158
                                                                                  api.ipify.orgQuotation 0048484.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  msXkgFIUyS.rtfGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  remittance payment of invoice DMWW24009.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  NOA, BL and invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  https://worker-royal-sun-1090.nipocas604.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                  • 172.67.74.152
                                                                                  z158xIuvhauCQiddTe.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.12.205
                                                                                  z34PDnVzyEItkXaInw.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  https://webex-install.comGet hashmaliciousNetSupport RATBrowse
                                                                                  • 104.26.13.205
                                                                                  SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exeGet hashmaliciousCredGrabber, Meduza Stealer, PureLog StealerBrowse
                                                                                  • 172.67.74.152
                                                                                  gKN4xIjj5o.exeGet hashmaliciousCredGrabber, PureLog StealerBrowse
                                                                                  • 172.67.74.152

                                                                                  ASNs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  YANDEXRUhttp://www.makefun.onlineGet hashmaliciousCaptcha PhishBrowse
                                                                                  • 213.180.204.90
                                                                                  http://marvin-occentus.netGet hashmaliciousUnknownBrowse
                                                                                  • 87.250.251.119
                                                                                  http://h.top4top.ioGet hashmaliciousUnknownBrowse
                                                                                  • 77.88.55.60
                                                                                  https://www.tb-parts.ru/Get hashmaliciousUnknownBrowse
                                                                                  • 77.88.55.60
                                                                                  https://goo.su/mwrmXGet hashmaliciousUnknownBrowse
                                                                                  • 77.88.55.60
                                                                                  http://discovus.comGet hashmaliciousUnknownBrowse
                                                                                  • 87.250.251.119
                                                                                  https://telegra.ph/BTC-Transaction--702210-03-14?x85rGet hashmaliciousUnknownBrowse
                                                                                  • 87.250.251.134
                                                                                  https://steamfiller.ru/Get hashmaliciousUnknownBrowse
                                                                                  • 93.158.134.119
                                                                                  https://cchcontent.com/?k=d779c440edb57bd974c500d65f843657&type=mainstream&subtype=global&data1=pcGet hashmaliciousUnknownBrowse
                                                                                  • 5.255.255.77
                                                                                  https://clck.ru/38QShTGet hashmaliciousUnknownBrowse
                                                                                  • 213.180.204.24
                                                                                  CLOUDFLARENETUSQuotation 0048484.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  3otr19d5Oq.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                  • 104.21.77.31
                                                                                  msXkgFIUyS.rtfGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  http://bookstopbuzz.comGet hashmaliciousUnknownBrowse
                                                                                  • 23.227.38.65
                                                                                  remittance payment of invoice DMWW24009.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 104.26.13.205
                                                                                  2llKbb9pR7.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoaderBrowse
                                                                                  • 172.67.177.98
                                                                                  NOA, BL and invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  Hays_compiled_documents.ZIP.jsGet hashmaliciousUnknownBrowse
                                                                                  • 104.21.95.148
                                                                                  https://telegra.ph/Stephen-M-Hickey-04-10Get hashmaliciousHTMLPhisherBrowse
                                                                                  • 172.66.47.93
                                                                                  https://bestohiomortgagerate.com/dream/mer/7/nobody@nobody.orgGet hashmaliciousHTMLPhisherBrowse
                                                                                  • 104.17.2.184

                                                                                  JA3 Fingerprints

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  3b5074b1b5d032e5620f69f9f700ff0eQuotation 0048484.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  remittance payment of invoice DMWW24009.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  2llKbb9pR7.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoaderBrowse
                                                                                  • 172.67.74.152
                                                                                  NOA, BL and invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  Hays_compiled_documents.ZIP.jsGet hashmaliciousUnknownBrowse
                                                                                  • 172.67.74.152
                                                                                  MdeeRbWvqe.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoaderBrowse
                                                                                  • 172.67.74.152
                                                                                  bCsfnThSOV.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                  • 172.67.74.152
                                                                                  bCsfnThSOV.exeGet hashmaliciousPhemedrone StealerBrowse
                                                                                  • 172.67.74.152
                                                                                  z158xIuvhauCQiddTe.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152
                                                                                  z34PDnVzyEItkXaInw.exeGet hashmaliciousAgentTeslaBrowse
                                                                                  • 172.67.74.152

                                                                                  Dropped Files

                                                                                  ⊘No context

                                                                                  Created / dropped Files

                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\45brrQrxwH.exe.log

                                                                                  Download File
                                                                                  Process:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):1216
                                                                                  Entropy (8bit):5.34331486778365
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                  Malicious:false
                                                                                  Reputation:high, very likely benign file
                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XEWKUH.exe.log

                                                                                  Download File
                                                                                  Process:C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):1216
                                                                                  Entropy (8bit):5.34331486778365
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                  Malicious:false
                                                                                  Reputation:high, very likely benign file
                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):2232
                                                                                  Entropy (8bit):5.380805901110357
                                                                                  Encrypted:false
                                                                                  SSDEEP:48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:lGLHyIFKL3IZ2KRH9Oug8s
                                                                                  MD5:F9B7CF60C22DBE6B73266580FFD54629
                                                                                  SHA1:05ED734C0A5EF2ECD025D4E39321ECDC96612623
                                                                                  SHA-256:880A3240A482AB826198F84F548F4CB5B906E4A2D7399D19E3EF60916B8D2D89
                                                                                  SHA-512:F55EFB17C1A45D594D165B9DC4FA2D1364B38AA2B0D1B3BAAE6E1E14B8F3BD77E3A28B7D89FA7F6BF3EEF3652434228B1A42BF9851F2CFBB6A7DCC0254AAAE38
                                                                                  Malicious:false
                                                                                  Preview:@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42je1sfx.03f.psm1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcgfpzw5.w3t.psm1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_go252xjx.txz.ps1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hycgfdcy.xlg.ps1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_okpkk2nj.ahp.ps1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_se303tbl.oa0.psm1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xputypb2.s4g.psm1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuvhpig3.ge3.ps1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:ASCII text, with no line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):60
                                                                                  Entropy (8bit):4.038920595031593
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                  Malicious:false
                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                  C:\Users\user\AppData\Local\Temp\tmp365A.tmp

                                                                                  Download File
                                                                                  Process:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  File Type:XML 1.0 document, ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):1572
                                                                                  Entropy (8bit):5.115151980727059
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtau+xvn:cge1wYrFdOFzOzN33ODOiDdKrsuT7yv
                                                                                  MD5:7F2259387FF098B9D338AC7BA7DFF967
                                                                                  SHA1:79F6576A883BFD5EA0B54F7BA0D52D629E31EFEF
                                                                                  SHA-256:64824EFE7AD415A19F331008C3EB1D1BEF318208321B72961939A534BC743756
                                                                                  SHA-512:939999FF6C2393320191CE34647CA3EF71F5A4627D9532F9CABC6785B07BA5763EA3800F60D8A5AC5824B89A524F2D89DB381B9C05C4DDB78EED17AD3D57F0BF
                                                                                  Malicious:true
                                                                                  Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

                                                                                  C:\Users\user\AppData\Local\Temp\tmp4771.tmp

                                                                                  Download File
                                                                                  Process:C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  File Type:XML 1.0 document, ASCII text
                                                                                  Category:dropped
                                                                                  Size (bytes):1572
                                                                                  Entropy (8bit):5.115151980727059
                                                                                  Encrypted:false
                                                                                  SSDEEP:24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtau+xvn:cge1wYrFdOFzOzN33ODOiDdKrsuT7yv
                                                                                  MD5:7F2259387FF098B9D338AC7BA7DFF967
                                                                                  SHA1:79F6576A883BFD5EA0B54F7BA0D52D629E31EFEF
                                                                                  SHA-256:64824EFE7AD415A19F331008C3EB1D1BEF318208321B72961939A534BC743756
                                                                                  SHA-512:939999FF6C2393320191CE34647CA3EF71F5A4627D9532F9CABC6785B07BA5763EA3800F60D8A5AC5824B89A524F2D89DB381B9C05C4DDB78EED17AD3D57F0BF
                                                                                  Malicious:false
                                                                                  Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

                                                                                  C:\Users\user\AppData\Roaming\XEWKUH.exe

                                                                                  Download File
                                                                                  Process:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                  Category:dropped
                                                                                  Size (bytes):666120
                                                                                  Entropy (8bit):7.984133069410215
                                                                                  Encrypted:false
                                                                                  SSDEEP:12288:kkvq31eoWxRl1d7EmIsoY+rq5hUo22vKY8kALxwtOzfnzRxaMpTjAB8d45VIo6w3:keqF8d4mIn6UoVvKY8BGCfnzR3pTM8Sx
                                                                                  MD5:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  SHA1:DC5D8ED078CF6225E133C228670EDAC311AF28B2
                                                                                  SHA-256:64C3F8BF923B9869C7B0F2A77EB1B1DB64EAE1CAEC23FA0DA3DA85C2C885B139
                                                                                  SHA-512:280184ECC259C57D4F09D53C3A71F648049539FE864FBC108FC806F8E4578CF13E25EDA98FFAF4E7170ED9B5EAB4A5FC1CFE9306E90B05AF5DC9430C6F0B94A8
                                                                                  Malicious:true
                                                                                  Antivirus:
                                                                                  • Antivirus: Avira, Detection: 100%
                                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                  • Antivirus: ReversingLabs, Detection: 68%
                                                                                  • Antivirus: Virustotal, Detection: 70%, Browse
                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?c.f..............0.............z.... ... ....@.. .......................`............@.................................%...O.... ..d................6...@......t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...d.... ......................@..@.reloc.......@......................@..B................Y.......H...........$............M..............................................^..}.....(.......(.....*.0..+.........,..{.......+....,...{....o........(.....*v..(......r...p(.......(.....*^..}.....(.......(.....*...{....r...p.o.....1....o.....1...(....o.....*.0..+.........,..{.......+....,...{....o........(.....*..0................( ...s!.....s"...}.....s....}.....s....}.....s....}.....s....}.....(......{.....o#.....{......s$...o%.....{....r%..po......{........s&...o'.....{.....o(..

                                                                                  C:\Users\user\AppData\Roaming\XEWKUH.exe:Zone.Identifier

                                                                                  Download File
                                                                                  Process:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):26
                                                                                  Entropy (8bit):3.95006375643621
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:ggPYV:rPYV
                                                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                  Malicious:false
                                                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                                                  Static File Info

                                                                                  General

                                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                  Entropy (8bit):7.984133069410215
                                                                                  TrID:
                                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                  • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                  • DOS Executable Generic (2002/1) 0.01%
                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                  File name:45brrQrxwH.exe
                                                                                  File size:666'120 bytes
                                                                                  MD5:cfaf6fedf4a8954df63b75e1574e66b3
                                                                                  SHA1:dc5d8ed078cf6225e133c228670edac311af28b2
                                                                                  SHA256:64c3f8bf923b9869c7b0f2a77eb1b1db64eae1caec23fa0da3da85c2c885b139
                                                                                  SHA512:280184ecc259c57d4f09d53c3a71f648049539fe864fbc108fc806f8e4578cf13e25eda98ffaf4e7170ed9b5eab4a5fc1cfe9306e90b05af5dc9430c6f0b94a8
                                                                                  SSDEEP:12288:kkvq31eoWxRl1d7EmIsoY+rq5hUo22vKY8kALxwtOzfnzRxaMpTjAB8d45VIo6w3:keqF8d4mIn6UoVvKY8BGCfnzR3pTM8Sx
                                                                                  TLSH:D6E423C78B0A37A7D69E8F34229B3983B77270D3546CC524509AC34CDF89B65F8EA506
                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?c.f..............0.............z.... ... ....@.. .......................`............@................................

                                                                                  File Icon

                                                                                  Icon Hash:90cececece8e8eb0

                                                                                  Static PE Info

                                                                                  General

                                                                                  Entrypoint:0x4a067a
                                                                                  Entrypoint Section:.text
                                                                                  Digitally signed:true
                                                                                  Imagebase:0x400000
                                                                                  Subsystem:windows gui
                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                  Time Stamp:0x6618633F [Thu Apr 11 22:25:03 2024 UTC]
                                                                                  TLS Callbacks:
                                                                                  CLR (.Net) Version:
                                                                                  OS Version Major:4
                                                                                  OS Version Minor:0
                                                                                  File Version Major:4
                                                                                  File Version Minor:0
                                                                                  Subsystem Version Major:4
                                                                                  Subsystem Version Minor:0
                                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                  Authenticode Signature

                                                                                  Signature Valid:false
                                                                                  Signature Issuer:CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
                                                                                  Signature Validation Error:The digital signature of the object did not verify
                                                                                  Error Number:-2146869232
                                                                                  Not Before, Not After
                                                                                  • 13/11/2018 00:00:00 08/11/2021 23:59:59
                                                                                  Subject Chain
                                                                                  • CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
                                                                                  Version:3
                                                                                  Thumbprint MD5:DABD77E44EF6B3BB91740FA46696B779
                                                                                  Thumbprint SHA-1:5B9E273CF11941FD8C6BE3F038C4797BBE884268
                                                                                  Thumbprint SHA-256:4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
                                                                                  Serial:7C1118CBBADC95DA3752C46E47A27438

                                                                                  Entrypoint Preview

                                                                                  Instruction
                                                                                  jmp dword ptr [00402000h]
                                                                                  inc edi
                                                                                  xor eax, 34473538h
                                                                                  add byte ptr [eax], al
                                                                                  xor byte ptr [ebp+32h], al
                                                                                  aaa
                                                                                  dec eax
                                                                                  inc ecx
                                                                                  cmp byte ptr [edx+ebx*2], dh
                                                                                  push ebx
                                                                                  xor eax, 344E5A35h
                                                                                  dec eax
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al
                                                                                  add byte ptr [eax], al

                                                                                  Data Directories

                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xa06250x4f.text
                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xa20000x664.rsrc
                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x9f4000x3608
                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xa40000xc.reloc
                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x9f5740x54.text
                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                  Sections

                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                  .text0x20000x9e6980x9e8009a350399aad964eec4eb828dc4a4cab0False0.9855718281742902data7.989229462300673IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                  .rsrc0xa20000x6640x8006c0e890396653d614673af460e70e758False0.3583984375data3.620325238809423IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                  .reloc0xa40000xc0x20082825439a25a4dd8f7827d68590cfb36False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                  Resources

                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                  RT_VERSION0xa20900x3d4data0.4346938775510204
                                                                                  RT_MANIFEST0xa24740x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                  Imports

                                                                                  DLLImport
                                                                                  mscoree.dll_CorExeMain

                                                                                  Network Behavior

                                                                                  Network Port Distribution

                                                                                  TCP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Apr 17, 2024 06:23:56.013379097 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.013427973 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.013499975 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.059544086 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.059568882 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.289104939 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.289192915 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.291548967 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.291574955 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.292090893 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.354423046 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.400160074 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.590723991 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.590881109 CEST44349735172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:56.593692064 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:56.620454073 CEST49735443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:57.622833967 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:57.870889902 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:57.871016026 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:58.359106064 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:58.359380007 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:58.608015060 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:58.608078957 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:58.608283043 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:58.857125998 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:58.857187986 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:58.857774019 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.107819080 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.107882977 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.107923031 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.107961893 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.108000040 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.108009100 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.108072996 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.114706993 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.363138914 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.369801044 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.617777109 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.619210005 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:23:59.849961996 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:59.850056887 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.850171089 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:59.853635073 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:23:59.853674889 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.867738962 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:23:59.868058920 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.075949907 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.076050997 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:24:00.077299118 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:24:00.077315092 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.077651978 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.120475054 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:24:00.139475107 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.139760971 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.168126106 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.385725021 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.385807037 CEST44349739172.67.74.152192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.385947943 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:24:00.388385057 CEST49739443192.168.2.4172.67.74.152
                                                                                  Apr 17, 2024 06:24:00.394982100 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.395215034 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.658359051 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.658610106 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.790458918 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.906681061 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:00.907418013 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.907483101 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.907483101 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:00.907509089 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.029488087 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.029588938 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.155054092 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.155095100 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.410382986 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.450493097 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.611490965 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.611839056 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.698776960 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.698831081 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.698894024 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.699172974 CEST49737587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.700293064 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.850788116 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.850831032 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.851675034 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.943831921 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:01.943954945 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:01.944509983 CEST5874973777.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.092072964 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.092174053 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.092801094 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.331428051 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.334466934 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.334506989 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.334544897 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.334583044 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.334603071 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.334696054 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.336421013 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.403868914 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.404160976 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.575649977 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.581136942 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.646739960 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.646789074 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.647103071 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.820987940 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.821279049 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:02.890311956 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:02.891381025 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.060379982 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.060698032 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.135292053 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.135340929 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.135380983 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.135416985 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.135528088 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.135528088 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.137015104 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.315227032 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.315536022 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.379689932 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.380786896 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.564917088 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.567121983 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.623578072 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.623811007 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.811012983 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.811235905 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:03.866688013 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:03.866933107 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.050335884 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.051100016 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.051100016 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.051129103 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.051129103 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.120632887 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.120973110 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.290014982 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.290071011 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.370598078 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.370830059 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.531738997 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.563497066 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.618993044 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.619281054 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.802258015 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.802315950 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.802632093 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.802722931 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.804030895 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.861916065 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:04.863641977 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.863641977 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.863686085 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.863734961 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.863905907 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.863985062 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.864036083 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.864125967 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:04.864162922 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.053473949 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.053664923 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.106102943 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.106493950 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.106548071 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.109575033 CEST49740587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.147150040 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.355885983 CEST5874974077.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.357671022 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.407259941 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.431519985 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.431665897 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.680994034 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.681025982 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.681274891 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:05.930581093 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.930612087 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:05.931164026 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.181330919 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.182596922 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.182657957 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.182698965 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.182738066 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.182770967 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.182813883 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.184756041 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.434786081 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.436192989 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.686754942 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.687190056 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:06.936945915 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:06.942423105 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:07.215262890 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:07.215562105 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:07.475883007 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:07.531563044 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:07.808267117 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.073126078 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:08.125197887 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.361109972 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.610768080 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:08.611732006 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.611819983 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.611819983 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.611846924 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.612219095 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.612310886 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.612338066 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.612358093 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.612386942 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:24:08.861372948 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:08.861691952 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:09.207182884 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:24:09.250324965 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:20.358364105 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:25:20.358645916 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:24.212025881 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:25:24.212136030 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:37.313410997 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:37.314881086 CEST49741587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:37.564208984 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:25:37.565247059 CEST5874974177.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:25:40.813376904 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:40.813704014 CEST49742587192.168.2.477.88.21.158
                                                                                  Apr 17, 2024 06:25:41.047753096 CEST5874974277.88.21.158192.168.2.4
                                                                                  Apr 17, 2024 06:25:41.047817945 CEST5874974277.88.21.158192.168.2.4

                                                                                  UDP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Apr 17, 2024 06:23:55.886976004 CEST6286253192.168.2.41.1.1.1
                                                                                  Apr 17, 2024 06:23:55.991487026 CEST53628621.1.1.1192.168.2.4
                                                                                  Apr 17, 2024 06:23:57.296144009 CEST5589853192.168.2.41.1.1.1
                                                                                  Apr 17, 2024 06:23:57.618470907 CEST53558981.1.1.1192.168.2.4

                                                                                  DNS Queries

                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                  Apr 17, 2024 06:23:55.886976004 CEST192.168.2.41.1.1.10xd42cStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                  Apr 17, 2024 06:23:57.296144009 CEST192.168.2.41.1.1.10x76f6Standard query (0)smtp.yandex.comA (IP address)IN (0x0001)false

                                                                                  DNS Answers

                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                  Apr 17, 2024 06:23:55.991487026 CEST1.1.1.1192.168.2.40xd42cNo error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                  Apr 17, 2024 06:23:55.991487026 CEST1.1.1.1192.168.2.40xd42cNo error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                                                  Apr 17, 2024 06:23:55.991487026 CEST1.1.1.1192.168.2.40xd42cNo error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                  Apr 17, 2024 06:23:57.618470907 CEST1.1.1.1192.168.2.40x76f6No error (0)smtp.yandex.comsmtp.yandex.ruCNAME (Canonical name)IN (0x0001)false
                                                                                  Apr 17, 2024 06:23:57.618470907 CEST1.1.1.1192.168.2.40x76f6No error (0)smtp.yandex.ru77.88.21.158A (IP address)IN (0x0001)false

                                                                                  HTTP Request Dependency Graph

                                                                                  • api.ipify.org

                                                                                  HTTPS Proxied Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.449735172.67.74.1524437892C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-04-17 04:23:56 UTC155OUTGET / HTTP/1.1
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
                                                                                  Host: api.ipify.org
                                                                                  Connection: Keep-Alive
                                                                                  2024-04-17 04:23:56 UTC211INHTTP/1.1 200 OK
                                                                                  Date: Wed, 17 Apr 2024 04:23:56 GMT
                                                                                  Content-Type: text/plain
                                                                                  Content-Length: 12
                                                                                  Connection: close
                                                                                  Vary: Origin
                                                                                  CF-Cache-Status: DYNAMIC
                                                                                  Server: cloudflare
                                                                                  CF-RAY: 8759a481ea21adcf-ATL
                                                                                  2024-04-17 04:23:56 UTC12INData Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32
                                                                                  Data Ascii: 81.181.57.52


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  1192.168.2.449739172.67.74.1524435996C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-04-17 04:24:00 UTC155OUTGET / HTTP/1.1
                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
                                                                                  Host: api.ipify.org
                                                                                  Connection: Keep-Alive
                                                                                  2024-04-17 04:24:00 UTC211INHTTP/1.1 200 OK
                                                                                  Date: Wed, 17 Apr 2024 04:24:00 GMT
                                                                                  Content-Type: text/plain
                                                                                  Content-Length: 12
                                                                                  Connection: close
                                                                                  Vary: Origin
                                                                                  CF-Cache-Status: DYNAMIC
                                                                                  Server: cloudflare
                                                                                  CF-RAY: 8759a499a9b2673f-ATL
                                                                                  2024-04-17 04:24:00 UTC12INData Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32
                                                                                  Data Ascii: 81.181.57.52


                                                                                  SMTP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IPCommands
                                                                                  Apr 17, 2024 06:23:58.359106064 CEST5874973777.88.21.158192.168.2.4220 mail-nwsmtp-smtp-production-main-17.iva.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1713327838-vN5ueh5Vr8c0
                                                                                  Apr 17, 2024 06:23:58.359380007 CEST49737587192.168.2.477.88.21.158EHLO 405464
                                                                                  Apr 17, 2024 06:23:58.608078957 CEST5874973777.88.21.158192.168.2.4250-mail-nwsmtp-smtp-production-main-17.iva.yp-c.yandex.net
                                                                                  250-8BITMIME
                                                                                  250-PIPELINING
                                                                                  250-SIZE 53477376
                                                                                  250-STARTTLS
                                                                                  250-AUTH LOGIN PLAIN XOAUTH2
                                                                                  250-DSN
                                                                                  250 ENHANCEDSTATUSCODES
                                                                                  Apr 17, 2024 06:23:58.608283043 CEST49737587192.168.2.477.88.21.158STARTTLS
                                                                                  Apr 17, 2024 06:23:58.857187986 CEST5874973777.88.21.158192.168.2.4220 Go ahead
                                                                                  Apr 17, 2024 06:24:01.611490965 CEST5874974077.88.21.158192.168.2.4220 mail-nwsmtp-smtp-production-main-19.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1713327841-1O5XhK08huQ0
                                                                                  Apr 17, 2024 06:24:01.611839056 CEST49740587192.168.2.477.88.21.158EHLO 405464
                                                                                  Apr 17, 2024 06:24:01.850831032 CEST5874974077.88.21.158192.168.2.4250-mail-nwsmtp-smtp-production-main-19.sas.yp-c.yandex.net
                                                                                  250-8BITMIME
                                                                                  250-PIPELINING
                                                                                  250-SIZE 53477376
                                                                                  250-STARTTLS
                                                                                  250-AUTH LOGIN PLAIN XOAUTH2
                                                                                  250-DSN
                                                                                  250 ENHANCEDSTATUSCODES
                                                                                  Apr 17, 2024 06:24:01.851675034 CEST49740587192.168.2.477.88.21.158STARTTLS
                                                                                  Apr 17, 2024 06:24:02.092174053 CEST5874974077.88.21.158192.168.2.4220 Go ahead
                                                                                  Apr 17, 2024 06:24:02.403868914 CEST5874974177.88.21.158192.168.2.4220 mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1713327842-2O5UpSBOg8c0
                                                                                  Apr 17, 2024 06:24:02.404160976 CEST49741587192.168.2.477.88.21.158EHLO 405464
                                                                                  Apr 17, 2024 06:24:02.646789074 CEST5874974177.88.21.158192.168.2.4250-mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net
                                                                                  250-8BITMIME
                                                                                  250-PIPELINING
                                                                                  250-SIZE 53477376
                                                                                  250-STARTTLS
                                                                                  250-AUTH LOGIN PLAIN XOAUTH2
                                                                                  250-DSN
                                                                                  250 ENHANCEDSTATUSCODES
                                                                                  Apr 17, 2024 06:24:02.647103071 CEST49741587192.168.2.477.88.21.158STARTTLS
                                                                                  Apr 17, 2024 06:24:02.890311956 CEST5874974177.88.21.158192.168.2.4220 Go ahead
                                                                                  Apr 17, 2024 06:24:05.431519985 CEST5874974277.88.21.158192.168.2.4220 mail-nwsmtp-smtp-production-main-46.myt.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1713327845-5O5sD666PeA0
                                                                                  Apr 17, 2024 06:24:05.431665897 CEST49742587192.168.2.477.88.21.158EHLO 405464
                                                                                  Apr 17, 2024 06:24:05.681025982 CEST5874974277.88.21.158192.168.2.4250-mail-nwsmtp-smtp-production-main-46.myt.yp-c.yandex.net
                                                                                  250-8BITMIME
                                                                                  250-PIPELINING
                                                                                  250-SIZE 53477376
                                                                                  250-STARTTLS
                                                                                  250-AUTH LOGIN PLAIN XOAUTH2
                                                                                  250-DSN
                                                                                  250 ENHANCEDSTATUSCODES
                                                                                  Apr 17, 2024 06:24:05.681274891 CEST49742587192.168.2.477.88.21.158STARTTLS
                                                                                  Apr 17, 2024 06:24:05.930612087 CEST5874974277.88.21.158192.168.2.4220 Go ahead

                                                                                  Statistics

                                                                                  CPU Usage

                                                                                  Click to jump to process

                                                                                  Memory Usage

                                                                                  Click to jump to process

                                                                                  High Level Behavior Distribution

                                                                                  Click to dive into process behavior distribution

                                                                                  Behavior

                                                                                  Click to jump to process

                                                                                  System Behavior

                                                                                  General

                                                                                  Target ID:0
                                                                                  Start time:06:23:50
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\user\Desktop\45brrQrxwH.exe"
                                                                                  Imagebase:0x870000
                                                                                  File size:666'120 bytes
                                                                                  MD5 hash:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1678240025.000000000496D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  Reputation:low
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:2
                                                                                  Start time:06:23:52
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\45brrQrxwH.exe"
                                                                                  Imagebase:0x50000
                                                                                  File size:433'152 bytes
                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:3
                                                                                  Start time:06:23:52
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:4
                                                                                  Start time:06:23:53
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XEWKUH.exe"
                                                                                  Imagebase:0x50000
                                                                                  File size:433'152 bytes
                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:5
                                                                                  Start time:06:23:53
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:6
                                                                                  Start time:06:23:53
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp365A.tmp"
                                                                                  Imagebase:0xad0000
                                                                                  File size:187'904 bytes
                                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:7
                                                                                  Start time:06:23:53
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:8
                                                                                  Start time:06:23:53
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Users\user\Desktop\45brrQrxwH.exe"
                                                                                  Imagebase:0x1a0000
                                                                                  File size:666'120 bytes
                                                                                  MD5 hash:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:low
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:9
                                                                                  Start time:06:23:54
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Users\user\Desktop\45brrQrxwH.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\user\Desktop\45brrQrxwH.exe"
                                                                                  Imagebase:0xb80000
                                                                                  File size:666'120 bytes
                                                                                  MD5 hash:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2876066217.000000000305B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2876066217.0000000003031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2876066217.0000000003031000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  Reputation:low
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:10
                                                                                  Start time:06:23:55
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                  Imagebase:0x7ff693ab0000
                                                                                  File size:496'640 bytes
                                                                                  MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:11
                                                                                  Start time:06:23:56
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  Imagebase:0x900000
                                                                                  File size:666'120 bytes
                                                                                  MD5 hash:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1717424225.0000000003CD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  Antivirus matches:
                                                                                  • Detection: 100%, Avira
                                                                                  • Detection: 100%, Joe Sandbox ML
                                                                                  • Detection: 68%, ReversingLabs
                                                                                  • Detection: 70%, Virustotal, Browse
                                                                                  Reputation:low
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:12
                                                                                  Start time:06:23:57
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEWKUH" /XML "C:\Users\user\AppData\Local\Temp\tmp4771.tmp"
                                                                                  Imagebase:0xad0000
                                                                                  File size:187'904 bytes
                                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:13
                                                                                  Start time:06:23:57
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:14
                                                                                  Start time:06:23:58
                                                                                  Start date:17/04/2024
                                                                                  Path:C:\Users\user\AppData\Roaming\XEWKUH.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\user\AppData\Roaming\XEWKUH.exe"
                                                                                  Imagebase:0xbc0000
                                                                                  File size:666'120 bytes
                                                                                  MD5 hash:CFAF6FEDF4A8954DF63B75E1574E66B3
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2870535189.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2875685208.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2875685208.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  Reputation:low
                                                                                  Has exited:false

                                                                                  Disassembly

                                                                                  Reset < >

                                                                                    Execution Graph

                                                                                    Execution Coverage:12.5%
                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                    Signature Coverage:3.8%
                                                                                    Total number of Nodes:209
                                                                                    Total number of Limit Nodes:14
                                                                                    execution_graph 22543 12a4668 22544 12a467a 22543->22544 22545 12a4686 22544->22545 22547 12a4778 22544->22547 22548 12a479d 22547->22548 22552 12a4878 22548->22552 22556 12a4888 22548->22556 22554 12a4888 22552->22554 22553 12a498c 22553->22553 22554->22553 22560 12a449c 22554->22560 22557 12a48af 22556->22557 22558 12a449c CreateActCtxA 22557->22558 22559 12a498c 22557->22559 22558->22559 22561 12a5918 CreateActCtxA 22560->22561 22563 12a59db 22561->22563 22764 12ad118 22765 12ad15e GetCurrentProcess 22764->22765 22767 12ad1a9 22765->22767 22768 12ad1b0 GetCurrentThread 22765->22768 22767->22768 22769 12ad1ed GetCurrentProcess 22768->22769 22770 12ad1e6 22768->22770 22771 12ad223 22769->22771 22770->22769 22772 12ad24b GetCurrentThreadId 22771->22772 22773 12ad27c 22772->22773 22774 12aad98 22775 12aada7 22774->22775 22778 12aae7f 22774->22778 22786 12aae90 22774->22786 22779 12aaea1 22778->22779 22780 12aaec4 22778->22780 22779->22780 22794 12ab128 22779->22794 22798 12ab118 22779->22798 22780->22775 22781 12aaebc 22781->22780 22782 12ab0c8 GetModuleHandleW 22781->22782 22783 12ab0f5 22782->22783 22783->22775 22787 12aaea1 22786->22787 22788 12aaec4 22786->22788 22787->22788 22792 12ab128 LoadLibraryExW 22787->22792 22793 12ab118 LoadLibraryExW 22787->22793 22788->22775 22789 12aaebc 22789->22788 22790 12ab0c8 GetModuleHandleW 22789->22790 22791 12ab0f5 22790->22791 22791->22775 22792->22789 22793->22789 22795 12ab13c 22794->22795 22797 12ab161 22795->22797 22802 12aa8d0 22795->22802 22797->22781 22799 12ab13c 22798->22799 22800 12aa8d0 LoadLibraryExW 22799->22800 22801 12ab161 22799->22801 22800->22801 22801->22781 22803 12ab308 LoadLibraryExW 22802->22803 22805 12ab381 22803->22805 22805->22797 22564 cb3bab8 22565 cb3bc43 22564->22565 22566 cb3bade 22564->22566 22566->22565 22568 cb38394 22566->22568 22569 cb3bd38 PostMessageW 22568->22569 22570 cb3bda4 22569->22570 22570->22566 22571 12ad421 22572 12ad428 22571->22572 22573 12ad3e4 DuplicateHandle 22572->22573 22575 12ad42e 22572->22575 22574 12ad3f6 22573->22574 22576 cb379ed 22581 cb3a8aa 22576->22581 22599 cb3a848 22576->22599 22616 cb3a858 22576->22616 22577 cb379fc 22582 cb3a880 22581->22582 22583 cb3a8b2 22581->22583 22593 cb3a87a 22582->22593 22633 cb3b105 22582->22633 22639 cb3afc5 22582->22639 22648 cb3aee6 22582->22648 22653 cb3b407 22582->22653 22657 cb3b362 22582->22657 22661 cb3aeb9 22582->22661 22666 cb3b095 22582->22666 22670 cb3ae71 22582->22670 22675 cb3b012 22582->22675 22681 cb3adac 22582->22681 22687 cb3af2d 22582->22687 22696 cb3ae08 22582->22696 22701 cb3ab88 22582->22701 22711 cb3af49 22582->22711 22583->22577 22593->22577 22600 cb3a858 22599->22600 22601 cb3b012 2 API calls 22600->22601 22602 cb3ae71 2 API calls 22600->22602 22603 cb3b095 2 API calls 22600->22603 22604 cb3aeb9 2 API calls 22600->22604 22605 cb3b362 2 API calls 22600->22605 22606 cb3b407 2 API calls 22600->22606 22607 cb3aee6 2 API calls 22600->22607 22608 cb3afc5 4 API calls 22600->22608 22609 cb3b105 2 API calls 22600->22609 22610 cb3a87a 22600->22610 22611 cb3af49 2 API calls 22600->22611 22612 cb3ab88 4 API calls 22600->22612 22613 cb3ae08 2 API calls 22600->22613 22614 cb3af2d 4 API calls 22600->22614 22615 cb3adac 2 API calls 22600->22615 22601->22610 22602->22610 22603->22610 22604->22610 22605->22610 22606->22610 22607->22610 22608->22610 22609->22610 22610->22577 22611->22610 22612->22610 22613->22610 22614->22610 22615->22610 22617 cb3a872 22616->22617 22618 cb3b012 2 API calls 22617->22618 22619 cb3ae71 2 API calls 22617->22619 22620 cb3b095 2 API calls 22617->22620 22621 cb3a87a 22617->22621 22622 cb3aeb9 2 API calls 22617->22622 22623 cb3b362 2 API calls 22617->22623 22624 cb3b407 2 API calls 22617->22624 22625 cb3aee6 2 API calls 22617->22625 22626 cb3afc5 4 API calls 22617->22626 22627 cb3b105 2 API calls 22617->22627 22628 cb3af49 2 API calls 22617->22628 22629 cb3ab88 4 API calls 22617->22629 22630 cb3ae08 2 API calls 22617->22630 22631 cb3af2d 4 API calls 22617->22631 22632 cb3adac 2 API calls 22617->22632 22618->22621 22619->22621 22620->22621 22621->22577 22622->22621 22623->22621 22624->22621 22625->22621 22626->22621 22627->22621 22628->22621 22629->22621 22630->22621 22631->22621 22632->22621 22635 cb3adb5 22633->22635 22634 cb3adc0 22634->22634 22635->22634 22716 cb37280 22635->22716 22720 cb37278 22635->22720 22636 cb3ae4c 22636->22593 22640 cb3afc9 22639->22640 22724 cb371c0 22640->22724 22728 cb371b8 22640->22728 22641 cb3adc0 22641->22641 22642 cb3adb5 22642->22641 22646 cb37280 WriteProcessMemory 22642->22646 22647 cb37278 WriteProcessMemory 22642->22647 22643 cb3ae4c 22643->22593 22646->22643 22647->22643 22649 cb3aee9 22648->22649 22732 cb370e2 22649->22732 22736 cb370e8 22649->22736 22650 cb3af04 22654 cb3b366 22653->22654 22654->22653 22740 cb37038 22654->22740 22744 cb37030 22654->22744 22658 cb3b366 22657->22658 22659 cb37030 ResumeThread 22658->22659 22660 cb37038 ResumeThread 22658->22660 22659->22658 22660->22658 22662 cb3b1af 22661->22662 22664 cb370e2 Wow64SetThreadContext 22662->22664 22665 cb370e8 Wow64SetThreadContext 22662->22665 22663 cb3b1ca 22663->22593 22664->22663 22665->22663 22748 cb37370 22666->22748 22752 cb37369 22666->22752 22667 cb3b0bb 22667->22593 22671 cb3ae77 22670->22671 22673 cb37280 WriteProcessMemory 22671->22673 22674 cb37278 WriteProcessMemory 22671->22674 22672 cb3ae99 22673->22672 22674->22672 22677 cb3adb5 22675->22677 22676 cb3adc0 22676->22676 22677->22676 22679 cb37280 WriteProcessMemory 22677->22679 22680 cb37278 WriteProcessMemory 22677->22680 22678 cb3ae4c 22678->22593 22679->22678 22680->22678 22683 cb3adb5 22681->22683 22682 cb3adc0 22682->22682 22683->22682 22685 cb37280 WriteProcessMemory 22683->22685 22686 cb37278 WriteProcessMemory 22683->22686 22684 cb3ae4c 22684->22593 22685->22684 22686->22684 22688 cb3afc9 22687->22688 22692 cb371c0 VirtualAllocEx 22688->22692 22693 cb371b8 VirtualAllocEx 22688->22693 22689 cb3adb5 22690 cb3adc0 22689->22690 22694 cb37280 WriteProcessMemory 22689->22694 22695 cb37278 WriteProcessMemory 22689->22695 22690->22690 22691 cb3ae4c 22691->22593 22692->22689 22693->22689 22694->22691 22695->22691 22697 cb3ae2f 22696->22697 22699 cb37280 WriteProcessMemory 22697->22699 22700 cb37278 WriteProcessMemory 22697->22700 22698 cb3b4f9 22699->22698 22700->22698 22703 cb3abcb 22701->22703 22702 cb3acb7 22702->22593 22703->22702 22756 cb37508 22703->22756 22760 cb374fd 22703->22760 22704 cb3adc0 22704->22704 22705 cb3ad86 22705->22704 22709 cb37280 WriteProcessMemory 22705->22709 22710 cb37278 WriteProcessMemory 22705->22710 22706 cb3ae4c 22706->22593 22709->22706 22710->22706 22712 cb3aee9 22711->22712 22714 cb370e2 Wow64SetThreadContext 22712->22714 22715 cb370e8 Wow64SetThreadContext 22712->22715 22713 cb3af04 22714->22713 22715->22713 22717 cb372c8 WriteProcessMemory 22716->22717 22719 cb3731f 22717->22719 22719->22636 22721 cb37280 WriteProcessMemory 22720->22721 22723 cb3731f 22721->22723 22723->22636 22725 cb37200 VirtualAllocEx 22724->22725 22727 cb3723d 22725->22727 22727->22642 22729 cb371c0 VirtualAllocEx 22728->22729 22731 cb3723d 22729->22731 22731->22642 22733 cb3712d Wow64SetThreadContext 22732->22733 22735 cb37175 22733->22735 22735->22650 22737 cb3712d Wow64SetThreadContext 22736->22737 22739 cb37175 22737->22739 22739->22650 22741 cb37078 ResumeThread 22740->22741 22743 cb370a9 22741->22743 22743->22654 22745 cb37038 ResumeThread 22744->22745 22747 cb370a9 22745->22747 22747->22654 22749 cb373bb ReadProcessMemory 22748->22749 22751 cb373ff 22749->22751 22751->22667 22753 cb37370 ReadProcessMemory 22752->22753 22755 cb373ff 22753->22755 22755->22667 22757 cb37591 CreateProcessA 22756->22757 22759 cb37753 22757->22759 22759->22759 22761 cb37591 22760->22761 22761->22761 22762 cb376f6 CreateProcessA 22761->22762 22763 cb37753 22762->22763 22763->22763

                                                                                    Executed Functions

                                                                                    Function 0CB3C7E0 Relevance: .7, Instructions: 654COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 111dda31bd8d7f311f1d4f5004cbe0515ce2f9f90496825dab69f1b349c99b25
                                                                                    • Instruction ID: 0b151e98973be6cb05bb54ade80220d4d6f6a3577d6b5418e9dff210ae54f089
                                                                                    • Opcode Fuzzy Hash: 111dda31bd8d7f311f1d4f5004cbe0515ce2f9f90496825dab69f1b349c99b25
                                                                                    • Instruction Fuzzy Hash: B332BD31B012048FDB19DBB9C550BAEBBF6EF89700F2445A9E146AB3A1CB35ED05CB51
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AFC18 Relevance: .2, Instructions: 212COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d18a42807a8c51a86e19b0b46d217a5e4fc7f3c2f31693388d0d324c272c7b44
                                                                                    • Instruction ID: f651c73edf9461e59e0b97771e689a776da721b385b694ddb4bd6349ebfdccb8
                                                                                    • Opcode Fuzzy Hash: d18a42807a8c51a86e19b0b46d217a5e4fc7f3c2f31693388d0d324c272c7b44
                                                                                    • Instruction Fuzzy Hash: 6291B470E116198BDB54EFA9C9406DDFBB2FF89300F20C169D518BB251EB346A86CF50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB3AB88 Relevance: .2, Instructions: 188COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: bfc3085f8d40661230428ab95a78c5d2d75ded7b246170150eef772ffa40924b
                                                                                    • Instruction ID: b887a28b9f25e8a677047e587b28a72580469d06fa5c36f8253a3ffb32548769
                                                                                    • Opcode Fuzzy Hash: bfc3085f8d40661230428ab95a78c5d2d75ded7b246170150eef772ffa40924b
                                                                                    • Instruction Fuzzy Hash: 8E810675E052288FDB24CFA6CC407EDBBB6BF89300F2491EAD409A6255EB715A85DF40
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AFC09 Relevance: .2, Instructions: 181COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 60a55d7a3eb100b7908bfda99d5cf07081f626bf9abc01620456a69c70ac0519
                                                                                    • Instruction ID: f4f6d6995ae40d3261732be1628ab2dd43a2e48d2cafb26306511b41aebcd917
                                                                                    • Opcode Fuzzy Hash: 60a55d7a3eb100b7908bfda99d5cf07081f626bf9abc01620456a69c70ac0519
                                                                                    • Instruction Fuzzy Hash: 2681D471E102198BDB14EFA9C9406DDFBB2FF89300F61C169D518BB251EB346A86CF50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB38049 Relevance: .1, Instructions: 115COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 104c79d836d3ff445207d53ebe7ab6aec022f84220482b135182358dd03634af
                                                                                    • Instruction ID: 552ecd18fcf2e2aaa77d700a3d70643a68dde169b0abdf46c5fb4d2e365a5c29
                                                                                    • Opcode Fuzzy Hash: 104c79d836d3ff445207d53ebe7ab6aec022f84220482b135182358dd03634af
                                                                                    • Instruction Fuzzy Hash: E6414A74E49A08CBDB14CFAAD4442EDFBF9AF8D300F24B06AE40AA7295DB754445CE42
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB3117B Relevance: .1, Instructions: 112COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 71e57447e502f6538c127734bc4f5a92728833e29c174eabe3caa6772ad2a27e
                                                                                    • Instruction ID: 838399849422c018d088234d1a58f6d24f75295a31a7e915f0f403b11861ecd4
                                                                                    • Opcode Fuzzy Hash: 71e57447e502f6538c127734bc4f5a92728833e29c174eabe3caa6772ad2a27e
                                                                                    • Instruction Fuzzy Hash: AE412E74E096088FDB04CFAED8406EEBBFAAF8D300F14E0A9E419A7251DB345941CB58
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB318AB Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 086d777628b4b7cf7d6d3660d80169b993c733d8792a21d65bc1048e7b559b05
                                                                                    • Instruction ID: e4f47f50521c3ee067146831939a7c5c530fb056f7dfaf3329526f7937283fea
                                                                                    • Opcode Fuzzy Hash: 086d777628b4b7cf7d6d3660d80169b993c733d8792a21d65bc1048e7b559b05
                                                                                    • Instruction Fuzzy Hash: 17316DB1D056488FEB19CFAAC8443DEBFF6AF89300F14D4AAD4086B255DB740549CF51
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB318B8 Relevance: .1, Instructions: 56COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 34ae56cac9b29e9ba24567834d23c424e1e07a10baeeff30dc41462119749fed
                                                                                    • Instruction ID: 4a7840bf8286d46f196fef40b9b80f071599bc510eda0da5bf9ca307258a2db1
                                                                                    • Opcode Fuzzy Hash: 34ae56cac9b29e9ba24567834d23c424e1e07a10baeeff30dc41462119749fed
                                                                                    • Instruction Fuzzy Hash: D321A2B1D006188BEB18CF9BD8457DEFAFBAFC8300F14D06AD40866264DB74094ACF90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB3AECB Relevance: .0, Instructions: 8COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 55c10b4650b32858b5bc840b6b6d1fa52b669365cf05f96376d35d581e7c38c7
                                                                                    • Instruction ID: c2abba8b3f60b8fd9ab1f65283d761e678814429cae7672abb661b0cecb6ebcb
                                                                                    • Opcode Fuzzy Hash: 55c10b4650b32858b5bc840b6b6d1fa52b669365cf05f96376d35d581e7c38c7
                                                                                    • Instruction Fuzzy Hash: 40A00290C9E148C385011C6049454F4F23C675B450D6034C8044E3301A0801C008500C
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AD108 Relevance: 6.1, APIs: 4, Instructions: 134threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 294 12ad108-12ad1a7 GetCurrentProcess 298 12ad1a9-12ad1af 294->298 299 12ad1b0-12ad1e4 GetCurrentThread 294->299 298->299 300 12ad1ed-12ad221 GetCurrentProcess 299->300 301 12ad1e6-12ad1ec 299->301 303 12ad22a-12ad245 call 12ad2e9 300->303 304 12ad223-12ad229 300->304 301->300 307 12ad24b-12ad27a GetCurrentThreadId 303->307 304->303 308 12ad27c-12ad282 307->308 309 12ad283-12ad2e5 307->309 308->309
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32 ref: 012AD196
                                                                                    • GetCurrentThread.KERNEL32 ref: 012AD1D3
                                                                                    • GetCurrentProcess.KERNEL32 ref: 012AD210
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 012AD269
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Current$ProcessThread
                                                                                    • String ID:
                                                                                    • API String ID: 2063062207-0
                                                                                    • Opcode ID: 9bde343ee41f3250f06879fce9b445553629fd21a0161b7488e03fbdd1c17d81
                                                                                    • Instruction ID: 184d6d6e02cc399a86feaaf7d685a6477234c4f4f5f19ed30120edf40e6999db
                                                                                    • Opcode Fuzzy Hash: 9bde343ee41f3250f06879fce9b445553629fd21a0161b7488e03fbdd1c17d81
                                                                                    • Instruction Fuzzy Hash: C45175B0D002498FDB04DFA9D988B9EBBF1EF88304F20C569E159A73A1DB349944CF65
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AD118 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 316 12ad118-12ad1a7 GetCurrentProcess 320 12ad1a9-12ad1af 316->320 321 12ad1b0-12ad1e4 GetCurrentThread 316->321 320->321 322 12ad1ed-12ad221 GetCurrentProcess 321->322 323 12ad1e6-12ad1ec 321->323 325 12ad22a-12ad245 call 12ad2e9 322->325 326 12ad223-12ad229 322->326 323->322 329 12ad24b-12ad27a GetCurrentThreadId 325->329 326->325 330 12ad27c-12ad282 329->330 331 12ad283-12ad2e5 329->331 330->331
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32 ref: 012AD196
                                                                                    • GetCurrentThread.KERNEL32 ref: 012AD1D3
                                                                                    • GetCurrentProcess.KERNEL32 ref: 012AD210
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 012AD269
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Current$ProcessThread
                                                                                    • String ID:
                                                                                    • API String ID: 2063062207-0
                                                                                    • Opcode ID: 49a7096d6672064fc1fda9a79ee79a1bad1b8ba4e6191be8f0805395d58cc750
                                                                                    • Instruction ID: 247db11a80efb26bfb6de2953d5ca299c2683360aa92c4706efa122f535f8de8
                                                                                    • Opcode Fuzzy Hash: 49a7096d6672064fc1fda9a79ee79a1bad1b8ba4e6191be8f0805395d58cc750
                                                                                    • Instruction Fuzzy Hash: AE5155B09002098FDB14DFA9D988B9EBBF1EF88314F20C559E519A7261DB34A984CF65
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB374FD Relevance: 1.7, APIs: 1, Instructions: 247processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 412 cb374fd-cb3759d 414 cb375d6-cb375f6 412->414 415 cb3759f-cb375a9 412->415 420 cb375f8-cb37602 414->420 421 cb3762f-cb3765e 414->421 415->414 416 cb375ab-cb375ad 415->416 417 cb375d0-cb375d3 416->417 418 cb375af-cb375b9 416->418 417->414 422 cb375bb 418->422 423 cb375bd-cb375cc 418->423 420->421 424 cb37604-cb37606 420->424 431 cb37660-cb3766a 421->431 432 cb37697-cb37751 CreateProcessA 421->432 422->423 423->423 425 cb375ce 423->425 426 cb37629-cb3762c 424->426 427 cb37608-cb37612 424->427 425->417 426->421 429 cb37616-cb37625 427->429 430 cb37614 427->430 429->429 433 cb37627 429->433 430->429 431->432 434 cb3766c-cb3766e 431->434 443 cb37753-cb37759 432->443 444 cb3775a-cb377e0 432->444 433->426 436 cb37691-cb37694 434->436 437 cb37670-cb3767a 434->437 436->432 438 cb3767e-cb3768d 437->438 439 cb3767c 437->439 438->438 441 cb3768f 438->441 439->438 441->436 443->444 454 cb377e2-cb377e6 444->454 455 cb377f0-cb377f4 444->455 454->455 456 cb377e8 454->456 457 cb377f6-cb377fa 455->457 458 cb37804-cb37808 455->458 456->455 457->458 459 cb377fc 457->459 460 cb3780a-cb3780e 458->460 461 cb37818-cb3781c 458->461 459->458 460->461 462 cb37810 460->462 463 cb3782e-cb37835 461->463 464 cb3781e-cb37824 461->464 462->461 465 cb37837-cb37846 463->465 466 cb3784c 463->466 464->463 465->466 468 cb3784d 466->468 468->468
                                                                                    APIs
                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0CB3773E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: 717754f0c2686a7c36d1b7519962612eebbf86d7861d557203e5b83a4f532a0f
                                                                                    • Instruction ID: 6acbc5afca09f33d4e9998617d53f8a288ca3be39da187015544c9aa7efcfc43
                                                                                    • Opcode Fuzzy Hash: 717754f0c2686a7c36d1b7519962612eebbf86d7861d557203e5b83a4f532a0f
                                                                                    • Instruction Fuzzy Hash: 10A148B1E00259CFDB24CF68C945BEDBBB2FB48314F1485AAD848B7250DB749985CF92
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37508 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 469 cb37508-cb3759d 471 cb375d6-cb375f6 469->471 472 cb3759f-cb375a9 469->472 477 cb375f8-cb37602 471->477 478 cb3762f-cb3765e 471->478 472->471 473 cb375ab-cb375ad 472->473 474 cb375d0-cb375d3 473->474 475 cb375af-cb375b9 473->475 474->471 479 cb375bb 475->479 480 cb375bd-cb375cc 475->480 477->478 481 cb37604-cb37606 477->481 488 cb37660-cb3766a 478->488 489 cb37697-cb37751 CreateProcessA 478->489 479->480 480->480 482 cb375ce 480->482 483 cb37629-cb3762c 481->483 484 cb37608-cb37612 481->484 482->474 483->478 486 cb37616-cb37625 484->486 487 cb37614 484->487 486->486 490 cb37627 486->490 487->486 488->489 491 cb3766c-cb3766e 488->491 500 cb37753-cb37759 489->500 501 cb3775a-cb377e0 489->501 490->483 493 cb37691-cb37694 491->493 494 cb37670-cb3767a 491->494 493->489 495 cb3767e-cb3768d 494->495 496 cb3767c 494->496 495->495 498 cb3768f 495->498 496->495 498->493 500->501 511 cb377e2-cb377e6 501->511 512 cb377f0-cb377f4 501->512 511->512 513 cb377e8 511->513 514 cb377f6-cb377fa 512->514 515 cb37804-cb37808 512->515 513->512 514->515 516 cb377fc 514->516 517 cb3780a-cb3780e 515->517 518 cb37818-cb3781c 515->518 516->515 517->518 519 cb37810 517->519 520 cb3782e-cb37835 518->520 521 cb3781e-cb37824 518->521 519->518 522 cb37837-cb37846 520->522 523 cb3784c 520->523 521->520 522->523 525 cb3784d 523->525 525->525
                                                                                    APIs
                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0CB3773E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: 38414a030501a36826c2f2f246ab95dabf9fe7776798117d78010a6ab4220282
                                                                                    • Instruction ID: 5e0bd33675eb227a38ce93a66afc59f18b70c8ff99622c542fa184e8b169e3ff
                                                                                    • Opcode Fuzzy Hash: 38414a030501a36826c2f2f246ab95dabf9fe7776798117d78010a6ab4220282
                                                                                    • Instruction Fuzzy Hash: 499138B1E00219DFDB14CF69C945BAEBBB2FF48314F1485AAD808B7250DB749985CF92
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AAE90 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 526 12aae90-12aae9f 527 12aaecb-12aaecf 526->527 528 12aaea1-12aaeae call 12a9898 526->528 530 12aaee3-12aaf24 527->530 531 12aaed1-12aaedb 527->531 534 12aaeb0 528->534 535 12aaec4 528->535 537 12aaf31-12aaf3f 530->537 538 12aaf26-12aaf2e 530->538 531->530 581 12aaeb6 call 12ab128 534->581 582 12aaeb6 call 12ab118 534->582 535->527 539 12aaf63-12aaf65 537->539 540 12aaf41-12aaf46 537->540 538->537 545 12aaf68-12aaf6f 539->545 542 12aaf48-12aaf4f call 12aa874 540->542 543 12aaf51 540->543 541 12aaebc-12aaebe 541->535 544 12ab000-12ab0c0 541->544 549 12aaf53-12aaf61 542->549 543->549 576 12ab0c8-12ab0f3 GetModuleHandleW 544->576 577 12ab0c2-12ab0c5 544->577 547 12aaf7c-12aaf83 545->547 548 12aaf71-12aaf79 545->548 552 12aaf90-12aaf92 call 12aa884 547->552 553 12aaf85-12aaf8d 547->553 548->547 549->545 556 12aaf97-12aaf99 552->556 553->552 557 12aaf9b-12aafa3 556->557 558 12aafa6-12aafab 556->558 557->558 559 12aafc9-12aafd6 558->559 560 12aafad-12aafb4 558->560 567 12aafd8-12aaff6 559->567 568 12aaff9-12aafff 559->568 560->559 562 12aafb6-12aafc6 call 12aa894 call 12aa8a4 560->562 562->559 567->568 578 12ab0fc-12ab110 576->578 579 12ab0f5-12ab0fb 576->579 577->576 579->578 581->541 582->541
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 012AB0E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleModule
                                                                                    • String ID:
                                                                                    • API String ID: 4139908857-0
                                                                                    • Opcode ID: 2b6011f1d11866df9620d36b5dd15f55c0fe2bbb66ec4776b959173ff6d98a89
                                                                                    • Instruction ID: cb80f8981794e2248e6d9580ad32e758055fcfacdb99e2dcb1a251e75b19da4e
                                                                                    • Opcode Fuzzy Hash: 2b6011f1d11866df9620d36b5dd15f55c0fe2bbb66ec4776b959173ff6d98a89
                                                                                    • Instruction Fuzzy Hash: 097168B0A10B068FDB24DF29D54475ABBF5FF88304F008A2DD58AD7A50DB75E945CB90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012A590C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 583 12a590c-12a598c 585 12a598f-12a59d9 CreateActCtxA 583->585 587 12a59db-12a59e1 585->587 588 12a59e2-12a5a3c 585->588 587->588 595 12a5a4b-12a5a4f 588->595 596 12a5a3e-12a5a41 588->596 597 12a5a60 595->597 598 12a5a51-12a5a5d 595->598 596->595 600 12a5a61 597->600 598->597 600->600
                                                                                    APIs
                                                                                    • CreateActCtxA.KERNEL32(?), ref: 012A59C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Create
                                                                                    • String ID:
                                                                                    • API String ID: 2289755597-0
                                                                                    • Opcode ID: 9dcc875f48d0506daa2919ef9880fbb0732c150df1096b993f7a92924c8226d6
                                                                                    • Instruction ID: d9a8aaa476afca5dc3065069c7356de60306e824b34ef2a0d199b8a4a9ec51fd
                                                                                    • Opcode Fuzzy Hash: 9dcc875f48d0506daa2919ef9880fbb0732c150df1096b993f7a92924c8226d6
                                                                                    • Instruction Fuzzy Hash: 7D41F3B0D00719CFDB24DFA9C8847CEBBB5BF49314F2480AAD408AB251DB756986CF90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012A449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 601 12a449c-12a59d9 CreateActCtxA 605 12a59db-12a59e1 601->605 606 12a59e2-12a5a3c 601->606 605->606 613 12a5a4b-12a5a4f 606->613 614 12a5a3e-12a5a41 606->614 615 12a5a60 613->615 616 12a5a51-12a5a5d 613->616 614->613 618 12a5a61 615->618 616->615 618->618
                                                                                    APIs
                                                                                    • CreateActCtxA.KERNEL32(?), ref: 012A59C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Create
                                                                                    • String ID:
                                                                                    • API String ID: 2289755597-0
                                                                                    • Opcode ID: 2f5728629525ff926424ec93166a4309c7c83b2603839d5351b09fd2e83d0fa9
                                                                                    • Instruction ID: 379ae039fcaafc24f510c4ee24cba5e023869375a3e139682a236e4bfd3f1381
                                                                                    • Opcode Fuzzy Hash: 2f5728629525ff926424ec93166a4309c7c83b2603839d5351b09fd2e83d0fa9
                                                                                    • Instruction Fuzzy Hash: 6841F2B0D10719DBDB24DFAAC884B8EBBF5BF49304F24806AD408AB251DBB55985CF90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012A5A84 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 619 12a5a84-12a5a8f 621 12a5b09-12a5b2b 619->621
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e282c6de00dbce22f1835509fb1d48affff1474ba49f46a0a335a23f225ef204
                                                                                    • Instruction ID: 270520750486ba80c6c866cd46e8cd42ae535ba01de2be5c06fac2019c61b9fb
                                                                                    • Opcode Fuzzy Hash: e282c6de00dbce22f1835509fb1d48affff1474ba49f46a0a335a23f225ef204
                                                                                    • Instruction Fuzzy Hash: B331DDB1C1434ACFDF11CFA8C8457EEBBB0AF42314F64818AD445AB256D775998ACF81
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AD421 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 623 12ad421-12ad426 624 12ad428 623->624 625 12ad42a-12ad42c 624->625 626 12ad3e4-12ad3f4 DuplicateHandle 624->626 625->624 629 12ad42e-12ad54e 625->629 627 12ad3fd-12ad41a 626->627 628 12ad3f6-12ad3fc 626->628 628->627
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012AD3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: 5d5559ce353612e88a70aeef2f78c656f96f3e118dd2a795237cd1c1cc0d601a
                                                                                    • Instruction ID: 482b2694b10b4253de7f966eaa4a3ac376096a12a974726bf67d318d06127fe9
                                                                                    • Opcode Fuzzy Hash: 5d5559ce353612e88a70aeef2f78c656f96f3e118dd2a795237cd1c1cc0d601a
                                                                                    • Instruction Fuzzy Hash: 55319E38650390CFF7619F60F449BA97FA6F798720F50842AE9128F7D9CAB44885CF51
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37278 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 643 cb37278-cb372ce 646 cb372d0-cb372dc 643->646 647 cb372de-cb3731d WriteProcessMemory 643->647 646->647 649 cb37326-cb37356 647->649 650 cb3731f-cb37325 647->650 650->649
                                                                                    APIs
                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0CB37310
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3559483778-0
                                                                                    • Opcode ID: 4486f1c5554c7a019c942cc74f332ce89b754fa38a55799f8e59912b4ac31e1c
                                                                                    • Instruction ID: 991371ce3cbcd8336d5e46ad2c9d028509ff8cd4b0bee05261ad27f84e745ea6
                                                                                    • Opcode Fuzzy Hash: 4486f1c5554c7a019c942cc74f332ce89b754fa38a55799f8e59912b4ac31e1c
                                                                                    • Instruction Fuzzy Hash: 50215AB19003599FCB10DFA9C884BDEBBF4FF48310F108429E958A7250C7749545CBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37280 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 654 cb37280-cb372ce 656 cb372d0-cb372dc 654->656 657 cb372de-cb3731d WriteProcessMemory 654->657 656->657 659 cb37326-cb37356 657->659 660 cb3731f-cb37325 657->660 660->659
                                                                                    APIs
                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0CB37310
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3559483778-0
                                                                                    • Opcode ID: 7d7df21b08cf6c4c7c715492d361269b52808f281b87ba1d62e49f193bb87e8f
                                                                                    • Instruction ID: 65993e57cb1ac4c4f0a6f588dd720f74576364f132f3be42a04da6c2a157e3d9
                                                                                    • Opcode Fuzzy Hash: 7d7df21b08cf6c4c7c715492d361269b52808f281b87ba1d62e49f193bb87e8f
                                                                                    • Instruction Fuzzy Hash: CA2166B1900349DFCB10CFA9C884BEEBBF4FF48310F10842AE958A7250CB789945CBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37369 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 664 cb37369-cb373fd ReadProcessMemory 668 cb37406-cb37436 664->668 669 cb373ff-cb37405 664->669 669->668
                                                                                    APIs
                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0CB373F0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessRead
                                                                                    • String ID:
                                                                                    • API String ID: 1726664587-0
                                                                                    • Opcode ID: 29d6ace613e7551ea53dd103e4c7c6481820d72908d0ac6d0f6302077b45cee7
                                                                                    • Instruction ID: 9be2427b5fb31f51787ddb17e1f1f2e2c09e9413d77d77e0c6df892c7566a590
                                                                                    • Opcode Fuzzy Hash: 29d6ace613e7551ea53dd103e4c7c6481820d72908d0ac6d0f6302077b45cee7
                                                                                    • Instruction Fuzzy Hash: B62136B18002599FCB10DFAAC840AEEFBF4FF48310F10842AE959A7250C734A545CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB370E2 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0CB37166
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: 6972ea10adfac20a70b1438f5b55ea9d87adc4603b56a9e124b2e0298a397a03
                                                                                    • Instruction ID: c0f282004b292b681a7d4c6bb6a2cf81dcf7dbe46a5d80e4c48ba0659a1c835b
                                                                                    • Opcode Fuzzy Hash: 6972ea10adfac20a70b1438f5b55ea9d87adc4603b56a9e124b2e0298a397a03
                                                                                    • Instruction Fuzzy Hash: C92159B1D002098FCB10DFA9C4447EEBBF4EF48314F208429D558A7240CB789944CF95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB370E8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0CB37166
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: dc2f2696abef1960a7f5295ebf611549ca795b77671cbe1fabbd234890703fe6
                                                                                    • Instruction ID: 6331339d3198b66bab14a75d04f06a31202b68b8f8857aee2e699c9cf8a67946
                                                                                    • Opcode Fuzzy Hash: dc2f2696abef1960a7f5295ebf611549ca795b77671cbe1fabbd234890703fe6
                                                                                    • Instruction Fuzzy Hash: 872138B29003098FDB10DFAAC9857EEBBF4EF48324F14842AD559A7240CB789945CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37370 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0CB373F0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessRead
                                                                                    • String ID:
                                                                                    • API String ID: 1726664587-0
                                                                                    • Opcode ID: 6299fe5199a320f198a7c4aa53096c81380b9a54fa37c259baec5c9885e9f93b
                                                                                    • Instruction ID: 390c5da6f9e8cec31db196da9175cd9e1c2f4d6489a6a843947cd7ae9b57b5df
                                                                                    • Opcode Fuzzy Hash: 6299fe5199a320f198a7c4aa53096c81380b9a54fa37c259baec5c9885e9f93b
                                                                                    • Instruction Fuzzy Hash: 4D2128B19003599FCB10DFAAC844AEEFBF5FF48310F10842AE559A7250C7749545CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AD358 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012AD3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: 17bcb5550b23f3b673be3cbb250ec671cdd8208f1374dbcd2f3c88c36ada3618
                                                                                    • Instruction ID: 5a91e9eef3038d27893668694d5c2aaa95136a233a20103a96ca0fe88c76a3bf
                                                                                    • Opcode Fuzzy Hash: 17bcb5550b23f3b673be3cbb250ec671cdd8208f1374dbcd2f3c88c36ada3618
                                                                                    • Instruction Fuzzy Hash: E22112B5900209DFDB10CFAAD984ADEBFF4FB48324F14802AE918A7310D374A940CF60
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AD360 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012AD3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: d8b23a8dfc8b178f2560a3f50eae86e99687f1d572f289ad2acc2a11dc2ed530
                                                                                    • Instruction ID: af25dee69d926956fb74ab8f0da07760498575f62b7e373583ac44004232abbb
                                                                                    • Opcode Fuzzy Hash: d8b23a8dfc8b178f2560a3f50eae86e99687f1d572f289ad2acc2a11dc2ed530
                                                                                    • Instruction Fuzzy Hash: 3321E2B59002499FDB10CFAAD984ADEFFF8EB48320F14841AE958A7350C374A940CFA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB371B8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0CB3722E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: f3aac12df0306d8cbc47c63bba4cdec5cba0ca3cd36360ffada4b3309ae35865
                                                                                    • Instruction ID: 44003cb7a0638a6c74c57785a80772f620953877e94a8d092c5bad19bb41c46f
                                                                                    • Opcode Fuzzy Hash: f3aac12df0306d8cbc47c63bba4cdec5cba0ca3cd36360ffada4b3309ae35865
                                                                                    • Instruction Fuzzy Hash: 971144B29002489BCB20DFAAC844ADFBFF5EB89324F208419E559A7250CB75A545CFA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AA8D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012AB161,00000800,00000000,00000000), ref: 012AB372
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad
                                                                                    • String ID:
                                                                                    • API String ID: 1029625771-0
                                                                                    • Opcode ID: 0ac1279e33660c207430db18d3ceee4357269917a04b9dc18f344aea56993f57
                                                                                    • Instruction ID: a061ad05ac47e6b9774dce576edbfd6c37502f0e81e49ea8b2774f71cfb339ec
                                                                                    • Opcode Fuzzy Hash: 0ac1279e33660c207430db18d3ceee4357269917a04b9dc18f344aea56993f57
                                                                                    • Instruction Fuzzy Hash: E31112B69003499FDB20CF9AC844ADEFBF4EB48310F14852AE919A7610C3B5A945CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37030 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ResumeThread
                                                                                    • String ID:
                                                                                    • API String ID: 947044025-0
                                                                                    • Opcode ID: 7970f7ac5311bc4758bbed41088b40a35c153c13fceaa6e02f0cf9a6aab9eaff
                                                                                    • Instruction ID: 6c422bc3ea20bcd1371d3c17c4da0a6b09029ca6d95270a3e21ae568b0fb53bb
                                                                                    • Opcode Fuzzy Hash: 7970f7ac5311bc4758bbed41088b40a35c153c13fceaa6e02f0cf9a6aab9eaff
                                                                                    • Instruction Fuzzy Hash: EA1158B1D002488BCB20DFAAC8457DFFBF5EB88324F208829D559A7250CB79A545CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB371C0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0CB3722E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: bc31c09b3dbd0e524bb1d138274dd9e97f834547b53c9c96706b1c7c75d239fc
                                                                                    • Instruction ID: c83c7edcd99d1f5e7c677cd096e997ce3b3bfcf6c20af4a25cbb425a2c0f4f83
                                                                                    • Opcode Fuzzy Hash: bc31c09b3dbd0e524bb1d138274dd9e97f834547b53c9c96706b1c7c75d239fc
                                                                                    • Instruction Fuzzy Hash: 4F1137B29002499FCB20DFAAC844BDEFFF5EF88324F248419E559A7250CB75A544CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AB300 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012AB161,00000800,00000000,00000000), ref: 012AB372
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad
                                                                                    • String ID:
                                                                                    • API String ID: 1029625771-0
                                                                                    • Opcode ID: 920df01d89ac9afd5a09a0d74ef1902c5701906a5f2ef5e3da88e161c6bc8318
                                                                                    • Instruction ID: a0d9f8df5165bf19772638407f0ebc91b2fe6f768dedcdbe9884c14ccbfdeadc
                                                                                    • Opcode Fuzzy Hash: 920df01d89ac9afd5a09a0d74ef1902c5701906a5f2ef5e3da88e161c6bc8318
                                                                                    • Instruction Fuzzy Hash: F31123B6900249CFDB10CFAAC948ADEFFF4EB88314F14852AD919A7610C375A545CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB37038 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ResumeThread
                                                                                    • String ID:
                                                                                    • API String ID: 947044025-0
                                                                                    • Opcode ID: eee4176fa62afdf091335052d3879966069eb4050c07f87456f312446d19f68f
                                                                                    • Instruction ID: 8d319fa63615bd95fb8b34007b95acf139def3ba42ecb38755bbf81f5a249f97
                                                                                    • Opcode Fuzzy Hash: eee4176fa62afdf091335052d3879966069eb4050c07f87456f312446d19f68f
                                                                                    • Instruction Fuzzy Hash: AF116AB1D003488FCB20DFAAC8447DEFBF4EB88324F208429C459A7250CB79A544CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB38394 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0CB3BD95
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost
                                                                                    • String ID:
                                                                                    • API String ID: 410705778-0
                                                                                    • Opcode ID: 8bd1ddd94c1be181139f4706d79c3dc97435c33e387d186b7844b28728df8bc6
                                                                                    • Instruction ID: a51c2df79edb64d461cb7f3a485c4aceeee4b24a6284ff70313b0257de82a3fe
                                                                                    • Opcode Fuzzy Hash: 8bd1ddd94c1be181139f4706d79c3dc97435c33e387d186b7844b28728df8bc6
                                                                                    • Instruction Fuzzy Hash: F611F5B58003599FCB10DF99C844BDEBFF8EB48314F208459E558A7210C375A944CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012AB080 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNELBASE(00000000), ref: 012AB0E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleModule
                                                                                    • String ID:
                                                                                    • API String ID: 4139908857-0
                                                                                    • Opcode ID: d27c9d3ae88b326f643d86b7cad7d27e16b5d5055ca8aaeeee9ad790889a00f9
                                                                                    • Instruction ID: e74e57668abf8d7426d59483ac390d236be5812266044a60c66a8c098ea0c24c
                                                                                    • Opcode Fuzzy Hash: d27c9d3ae88b326f643d86b7cad7d27e16b5d5055ca8aaeeee9ad790889a00f9
                                                                                    • Instruction Fuzzy Hash: 1E110FB5C003498FDB20CF9AC844ADEFBF4AB89324F10842AD568A7210C375A545CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB3BD32 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0CB3BD95
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost
                                                                                    • String ID:
                                                                                    • API String ID: 410705778-0
                                                                                    • Opcode ID: 399e9c2d0b28a4df1ce27e1640ac9e03ea9e73c8a4e12aababdbab3b73873325
                                                                                    • Instruction ID: 2ebf1f594ca77c627722ed91b8c0c574c553c25674bef17c87ab946d616fffeb
                                                                                    • Opcode Fuzzy Hash: 399e9c2d0b28a4df1ce27e1640ac9e03ea9e73c8a4e12aababdbab3b73873325
                                                                                    • Instruction Fuzzy Hash: 3311F2B58002599FCB20CF99C889BEEBFF4EB48314F20845AE558A7210C375A944CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 00FFD3D8 Relevance: .1, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673518344.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_ffd000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e5d081be600b3c4b5bd402d74594acec79a401e918dc7da46cf7b5ed8878248d
                                                                                    • Instruction ID: 8099a20759270393e52d63f29b4ec3f5038cc39670d253b385bb9ba495c6c7d2
                                                                                    • Opcode Fuzzy Hash: e5d081be600b3c4b5bd402d74594acec79a401e918dc7da46cf7b5ed8878248d
                                                                                    • Instruction Fuzzy Hash: 26213A72500208DFDB05DF14D9C4B36BF66FF94324F20C169DA094B266C336E856E7A2
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0100D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673610089.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_100d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b36f08757b55ab4bf291d3cb7d9e3055444115d88e39cef495275348ceaeddee
                                                                                    • Instruction ID: 0088a7441bbe00897aaf2854a5741722d4029b77014a49536ac5d6fa0493184e
                                                                                    • Opcode Fuzzy Hash: b36f08757b55ab4bf291d3cb7d9e3055444115d88e39cef495275348ceaeddee
                                                                                    • Instruction Fuzzy Hash: C5210771504200EFEB06DFD8D5C0B2ABBA5FB94324F20C5ADE9894B296C736D446CB71
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0100D01C Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673610089.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_100d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f45b3f9fe447fa22a0454a6669c7b238234e088713d95f8ec619d4514eefe8e9
                                                                                    • Instruction ID: 68d802476f8ba44ba93844c7fc6aa5a8dd7a5d993b656649506c2112c295b9af
                                                                                    • Opcode Fuzzy Hash: f45b3f9fe447fa22a0454a6669c7b238234e088713d95f8ec619d4514eefe8e9
                                                                                    • Instruction Fuzzy Hash: 8E21F571604200DFEB16DF98D984B16BFA5EB84354F20C5ADE98D4B296C336D447CB71
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 00FFD3D3 Relevance: .1, Instructions: 56COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673518344.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_ffd000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction ID: 803295628148726fcb8aa9ef68cda6d90fc44538cfd0a069b63bcf6204071f47
                                                                                    • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction Fuzzy Hash: 51110672804244CFCB05CF00D5C4B26BF72FF94324F24C2A9D9090B666C33AD456DBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0100D017 Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673610089.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_100d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction ID: 44911f9d491f95544893abfcef7905d32e9690f1fdd31aca27cb2dae417c199a
                                                                                    • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction Fuzzy Hash: C2119075504280DFDB16CF94D5C4B15FFA2FB44314F24C6AAE84D4B696C33AD44ACB62
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0100D1CF Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673610089.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_100d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction ID: 6b2a6ae5ae6cba8fcbfeeaf0af7207f02dc1127a6503fda2c4fd61e80d9d90fb
                                                                                    • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction Fuzzy Hash: BA11BB75504280DFEB02CF98C5C4B15BFA1FB84224F24C6AAD8894B696C33AD40ACB62
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 00FFD745 Relevance: .0, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673518344.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_ffd000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 81268956029c7048b3e11276761ca174740c551c81f2a2d5e6caad31306a48b8
                                                                                    • Instruction ID: 562286f04121ad310ba327cb1f8d36a4eb037b41d333ee3ed6a238549e5d4ac0
                                                                                    • Opcode Fuzzy Hash: 81268956029c7048b3e11276761ca174740c551c81f2a2d5e6caad31306a48b8
                                                                                    • Instruction Fuzzy Hash: 7B012B334083489AE7116E26CD84B77FFD9DF41334F18C56AEE080E2A6C679D840D671
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 00FFD744 Relevance: .0, Instructions: 36COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1673518344.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_ffd000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 3e926601f81ca1a6017f45018b65f58a847981c70c4c2cf0fd6d89847360ae3c
                                                                                    • Instruction ID: d2aa1b09fa5295965dfccc83a1aa51684f64a05eb5d314e29f36313b5ac081a7
                                                                                    • Opcode Fuzzy Hash: 3e926601f81ca1a6017f45018b65f58a847981c70c4c2cf0fd6d89847360ae3c
                                                                                    • Instruction Fuzzy Hash: BBF0C2724083449AE7109E16C888B62FFA8EF51334F18C45AED080E2A6C2799840CBB0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    Function 0CB344C0 Relevance: .3, Instructions: 312COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 98a870e8d368c5939f39c1f12e1a85401fb56a1ac3a923ebc8c615f5e882e022
                                                                                    • Instruction ID: a1738f1d8c4ff278378db1010b24d65abf92e36ef94f170559c5570f9dc8623e
                                                                                    • Opcode Fuzzy Hash: 98a870e8d368c5939f39c1f12e1a85401fb56a1ac3a923ebc8c615f5e882e022
                                                                                    • Instruction Fuzzy Hash: EFE10974E011198FDB14DFA9C5809AEFBB2FF89304F2491A9E415AB356D730AD41CF61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB34D30 Relevance: .3, Instructions: 312COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b9f0bf9243cf9747b69a9ca7e7e129b8b82181f31fca9fccabb4b5367947350a
                                                                                    • Instruction ID: 9477ad5769b67ced3bf9f9239357f0bb060e63be74d0ff36909503b9a4889c79
                                                                                    • Opcode Fuzzy Hash: b9f0bf9243cf9747b69a9ca7e7e129b8b82181f31fca9fccabb4b5367947350a
                                                                                    • Instruction Fuzzy Hash: 8DE12974E001198FDB14DFA9C5809AEFBB2FF89304F2491A9E419AB356D731AD41CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB348F8 Relevance: .3, Instructions: 312COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0f9b9cdf392ece773b7929d93098a9e80ef67b6d8a4c096b6cdf4a3363366b2e
                                                                                    • Instruction ID: ca0d34146f0360cc6e9954bcdddff537fcd0cbd6d67e5b94077edb752451ce6f
                                                                                    • Opcode Fuzzy Hash: 0f9b9cdf392ece773b7929d93098a9e80ef67b6d8a4c096b6cdf4a3363366b2e
                                                                                    • Instruction Fuzzy Hash: 96E11974E011198FDB14DFA9C580AAEFBB2FF89304F249169E415AB35AD730AD41CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB36810 Relevance: .3, Instructions: 312COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 821b18058a6d2e85eb68463ce81eacfc0dd3ed30ed8dc259f1b4c7600375b0a4
                                                                                    • Instruction ID: f0cbea2e256459c7bcdd1383f8c7f9ead58b5aa10db37fcddf732b45091cf1f2
                                                                                    • Opcode Fuzzy Hash: 821b18058a6d2e85eb68463ce81eacfc0dd3ed30ed8dc259f1b4c7600375b0a4
                                                                                    • Instruction Fuzzy Hash: B8E11874E011199FDB14DFA9C580AAEFBB2FF88304F249169E815AB356D730AD41CF61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB363D8 Relevance: .3, Instructions: 312COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 18c60ab80b318f4a742a6e873085e8c361a470a3ec479c0168878ad0a43a7a4d
                                                                                    • Instruction ID: 64382ae93bf44dc9fe370f7b36b4055895835452330fd46949698edfe83cf5cb
                                                                                    • Opcode Fuzzy Hash: 18c60ab80b318f4a742a6e873085e8c361a470a3ec479c0168878ad0a43a7a4d
                                                                                    • Instruction Fuzzy Hash: 56E12A74E011199FDB14DFA9C5809AEFBB2FF88304F249169E815AB35AD730AD41CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 012ADCD4 Relevance: .3, Instructions: 264COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1674042546.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_12a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7c8809ff548035e597869f3f3be2ac115dabaa24502c67bc612c5ba929119969
                                                                                    • Instruction ID: 90bd615d162b3e8beed0b010c175103d88628e163ac653a3d0a34d48b05cce12
                                                                                    • Opcode Fuzzy Hash: 7c8809ff548035e597869f3f3be2ac115dabaa24502c67bc612c5ba929119969
                                                                                    • Instruction Fuzzy Hash: 77A19D32A1060A8FCF15DFB8D9445EEBBB2FF84300B54456AE905AB265DB35E906CF80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB348E8 Relevance: .1, Instructions: 136COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7b516e9951df5f3fc7238227899974df3e70f465ed571a42d738b1a373cfaf47
                                                                                    • Instruction ID: b64234e69d4e4f1dd3d1af59c4ba93806a08c0a65c595bfe55a2b6d7c99c1046
                                                                                    • Opcode Fuzzy Hash: 7b516e9951df5f3fc7238227899974df3e70f465ed571a42d738b1a373cfaf47
                                                                                    • Instruction Fuzzy Hash: 21510770E016198FDB15CFA9C5805AEFBF2FF89300F2491A9D418AB356D7319A42CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0CB36800 Relevance: .1, Instructions: 130COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.1685209864.000000000CB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 0CB30000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_2_cb30000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 136e78f22b77cff1677e10b861eb1b9526aadf56ff3d920b4923e9b813d30522
                                                                                    • Instruction ID: 6a87f734825233e17c2aa6d9f0ae958dea416497fcd1181135d4d0c50d098bbf
                                                                                    • Opcode Fuzzy Hash: 136e78f22b77cff1677e10b861eb1b9526aadf56ff3d920b4923e9b813d30522
                                                                                    • Instruction Fuzzy Hash: 9751FC70E012198FDB14DFA9C5805AEFBF2FF89304F2495AAE418AB356D7319941CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Execution Graph

                                                                                    Execution Coverage:14%
                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                    Signature Coverage:0%
                                                                                    Total number of Nodes:31
                                                                                    Total number of Limit Nodes:4
                                                                                    execution_graph 24628 13a0848 24630 13a084e 24628->24630 24629 13a091b 24630->24629 24632 13a1382 24630->24632 24633 13a1396 24632->24633 24634 13a1480 24633->24634 24638 13a7d98 24633->24638 24642 13a7eb0 24633->24642 24649 13a7d40 24633->24649 24634->24630 24639 13a7dae 24638->24639 24641 13a7f1a 24639->24641 24653 13af557 24639->24653 24641->24633 24643 13a7eba 24642->24643 24645 13a7ed4 24643->24645 24646 6c1fa08 GlobalMemoryStatusEx 24643->24646 24647 6c1fa18 GlobalMemoryStatusEx 24643->24647 24644 13a7f1a 24644->24633 24645->24644 24648 13af557 GlobalMemoryStatusEx 24645->24648 24646->24645 24647->24645 24648->24644 24650 13a7dae 24649->24650 24651 13af557 GlobalMemoryStatusEx 24650->24651 24652 13a7f1a 24650->24652 24651->24652 24652->24633 24654 13af562 24653->24654 24658 6c1fa08 24654->24658 24662 6c1fa18 24654->24662 24655 13af569 24655->24641 24659 6c1fa2d 24658->24659 24660 6c1fc42 24659->24660 24661 6c1fc59 GlobalMemoryStatusEx 24659->24661 24660->24655 24661->24659 24664 6c1fa2d 24662->24664 24663 6c1fc42 24663->24655 24664->24663 24665 6c1fc59 GlobalMemoryStatusEx 24664->24665 24665->24664

                                                                                    Executed Functions

                                                                                    Function 06C13040 Relevance: 8.0, Strings: 6, Instructions: 545COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 126 6c13040-6c13061 127 6c13063-6c13066 126->127 128 6c13068-6c13087 127->128 129 6c1308c-6c1308f 127->129 128->129 130 6c13830-6c13832 129->130 131 6c13095-6c130b4 129->131 132 6c13834 130->132 133 6c13839-6c1383c 130->133 139 6c130b6-6c130b9 131->139 140 6c130cd-6c130d7 131->140 132->133 133->127 135 6c13842-6c1384b 133->135 139->140 141 6c130bb-6c130cb 139->141 144 6c130dd-6c130ec 140->144 141->144 252 6c130ee call 6c13860 144->252 253 6c130ee call 6c13858 144->253 145 6c130f3-6c130f8 146 6c13105-6c133e2 145->146 147 6c130fa-6c13100 145->147 168 6c13822-6c1382f 146->168 169 6c133e8-6c13497 146->169 147->135 178 6c134c0 169->178 179 6c13499-6c134be 169->179 181 6c134c9-6c134dc 178->181 179->181 183 6c134e2-6c13504 181->183 184 6c13809-6c13815 181->184 183->184 187 6c1350a-6c13514 183->187 184->169 185 6c1381b 184->185 185->168 187->184 188 6c1351a-6c13525 187->188 188->184 189 6c1352b-6c13601 188->189 201 6c13603-6c13605 189->201 202 6c1360f-6c1363f 189->202 201->202 206 6c13641-6c13643 202->206 207 6c1364d-6c13659 202->207 206->207 208 6c136b9-6c136bd 207->208 209 6c1365b-6c1365f 207->209 210 6c136c3-6c136ff 208->210 211 6c137fa-6c13803 208->211 209->208 212 6c13661-6c1368b 209->212 223 6c13701-6c13703 210->223 224 6c1370d-6c1371b 210->224 211->184 211->189 219 6c13699-6c136b6 212->219 220 6c1368d-6c1368f 212->220 219->208 220->219 223->224 226 6c13732-6c1373d 224->226 227 6c1371d-6c13728 224->227 231 6c13755-6c13766 226->231 232 6c1373f-6c13745 226->232 227->226 230 6c1372a 227->230 230->226 236 6c13768-6c1376e 231->236 237 6c1377e-6c1378a 231->237 233 6c13747 232->233 234 6c13749-6c1374b 232->234 233->231 234->231 238 6c13770 236->238 239 6c13772-6c13774 236->239 241 6c137a2-6c137f3 237->241 242 6c1378c-6c13792 237->242 238->237 239->237 241->211 243 6c13794 242->243 244 6c13796-6c13798 242->244 243->241 244->241 252->145 253->145
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2392861976
                                                                                    • Opcode ID: 040dcf7cecc1209137b80b613b007e8d68547b0d1917cf2c623ba8634e33baec
                                                                                    • Instruction ID: 0f7e4988fb49335c7c3f17af61525c568e0ff8cb7b230cbeea0c5a58fb35d045
                                                                                    • Opcode Fuzzy Hash: 040dcf7cecc1209137b80b613b007e8d68547b0d1917cf2c623ba8634e33baec
                                                                                    • Instruction Fuzzy Hash: 35323D35E1065ACFCB14DF75C99459DB7B2FFC9304F1086AAD409AB264EF30AA85CB81
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C17D58 Relevance: 3.0, Strings: 2, Instructions: 473COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 959 6c17d58-6c17d76 960 6c17d78-6c17d7b 959->960 961 6c17d92-6c17d95 960->961 962 6c17d7d-6c17d8b 960->962 963 6c17da2-6c17da5 961->963 964 6c17d97-6c17da1 961->964 968 6c17d8d 962->968 969 6c17dfe-6c17e14 962->969 965 6c17da7-6c17dc1 963->965 966 6c17dc6-6c17dc9 963->966 965->966 970 6c17dcb-6c17de7 966->970 971 6c17dec-6c17dee 966->971 968->961 977 6c17e1a-6c17e23 969->977 978 6c1802f-6c18039 969->978 970->971 972 6c17df0 971->972 973 6c17df5-6c17df8 971->973 972->973 973->960 973->969 981 6c17e29-6c17e46 977->981 982 6c1803a-6c1806f 977->982 991 6c1801c-6c18029 981->991 992 6c17e4c-6c17e74 981->992 985 6c18071-6c18074 982->985 986 6c18127-6c1812a 985->986 987 6c1807a-6c18086 985->987 989 6c18130-6c1813f 986->989 990 6c18356-6c18359 986->990 993 6c18091-6c18093 987->993 1008 6c18141-6c1815c 989->1008 1009 6c1815e-6c18199 989->1009 994 6c1835b-6c18377 990->994 995 6c1837c-6c1837e 990->995 991->977 991->978 992->991 1013 6c17e7a-6c17e83 992->1013 997 6c18095-6c1809b 993->997 998 6c180ab-6c180b2 993->998 994->995 999 6c18380 995->999 1000 6c18385-6c18388 995->1000 1002 6c1809d 997->1002 1003 6c1809f-6c180a1 997->1003 1005 6c180c3 998->1005 1006 6c180b4-6c180c1 998->1006 999->1000 1000->985 1007 6c1838e-6c18397 1000->1007 1002->998 1003->998 1011 6c180c8-6c180ca 1005->1011 1006->1011 1008->1009 1018 6c1832a-6c18340 1009->1018 1019 6c1819f-6c181b0 1009->1019 1015 6c180e1-6c1811a 1011->1015 1016 6c180cc-6c180cf 1011->1016 1013->982 1020 6c17e89-6c17ea5 1013->1020 1015->989 1039 6c1811c-6c18126 1015->1039 1016->1007 1018->990 1027 6c18315-6c18324 1019->1027 1028 6c181b6-6c181d3 1019->1028 1029 6c17eab-6c17ed5 1020->1029 1030 6c1800a-6c18016 1020->1030 1027->1018 1027->1019 1028->1027 1040 6c181d9-6c182cf call 6c16580 1028->1040 1043 6c18000-6c18005 1029->1043 1044 6c17edb-6c17f03 1029->1044 1030->991 1030->1013 1092 6c182d1-6c182db 1040->1092 1093 6c182dd 1040->1093 1043->1030 1044->1043 1050 6c17f09-6c17f37 1044->1050 1050->1043 1056 6c17f3d-6c17f46 1050->1056 1056->1043 1057 6c17f4c-6c17f7e 1056->1057 1064 6c17f80-6c17f84 1057->1064 1065 6c17f89-6c17fa5 1057->1065 1064->1043 1067 6c17f86 1064->1067 1065->1030 1068 6c17fa7-6c17ffe call 6c16580 1065->1068 1067->1065 1068->1030 1094 6c182e2-6c182e4 1092->1094 1093->1094 1094->1027 1095 6c182e6-6c182eb 1094->1095 1096 6c182f9 1095->1096 1097 6c182ed-6c182f7 1095->1097 1098 6c182fe-6c18300 1096->1098 1097->1098 1098->1027 1099 6c18302-6c1830e 1098->1099 1099->1027
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q
                                                                                    • API String ID: 0-355816377
                                                                                    • Opcode ID: 964b89dc27b7c01e148f65affcc312257ab828803e230d99997e3b639ee73b87
                                                                                    • Instruction ID: e89a687dc026b47c1b7315efa2853c7e1b1b838d278528d622af221ac38a828f
                                                                                    • Opcode Fuzzy Hash: 964b89dc27b7c01e148f65affcc312257ab828803e230d99997e3b639ee73b87
                                                                                    • Instruction Fuzzy Hash: F502BD30B0120A9FDB54DF68D990AAEB7E2FF85300F148569E406DB394DB35ED86CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C165D0 Relevance: .8, Instructions: 816COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 85f1a654414ea440ec8344af88e6b84a90c3d5fba22e4150a09a71ea98778ba9
                                                                                    • Instruction ID: aaa8f976ca1737b3394acc76eef5d53e11cb4f2d45c9174c9e72e93dca533cd7
                                                                                    • Opcode Fuzzy Hash: 85f1a654414ea440ec8344af88e6b84a90c3d5fba22e4150a09a71ea98778ba9
                                                                                    • Instruction Fuzzy Hash: 0562CC34B002058FDB54DB69D594AAEB7F2EF8A314F148469E40AEF390DB35ED46DB80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C15578 Relevance: .6, Instructions: 603COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 05dc34b8942a56ecdd704f4e02fc42d3cd70e690039e7ec814d7e927aabcbf21
                                                                                    • Instruction ID: fa0fa21dee73713b8b797bc6173f760efa90eb0a19b31c5c76269e77e9456a4a
                                                                                    • Opcode Fuzzy Hash: 05dc34b8942a56ecdd704f4e02fc42d3cd70e690039e7ec814d7e927aabcbf21
                                                                                    • Instruction Fuzzy Hash: 6A22D2B5E102058FDB60DF64C4906AEBBF2EF8A320F50846AD459EF385DA35DD42CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1B20A Relevance: .6, Instructions: 566COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 04643cf95d4b04bd5430c3b5b3e9227f220df8926604be25d9dad633771144b6
                                                                                    • Instruction ID: 4fbc472d04facdda6d23f717c9bf0aa51626e66de0afee4925db9b681e9eb54b
                                                                                    • Opcode Fuzzy Hash: 04643cf95d4b04bd5430c3b5b3e9227f220df8926604be25d9dad633771144b6
                                                                                    • Instruction Fuzzy Hash: 01227434E102098FDF64DB68D5907AEB7B2FB86310F208929E409EF391DA35DD869F51
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1ACA8 Relevance: 10.4, Strings: 8, Instructions: 393COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 0 6c1aca8-6c1acc6 1 6c1acc8-6c1accb 0->1 2 6c1acd5-6c1acd8 1->2 3 6c1accd-6c1acd2 1->3 4 6c1acfb-6c1acfe 2->4 5 6c1acda-6c1acf6 2->5 3->2 6 6c1ad00-6c1ad04 4->6 7 6c1ad0f-6c1ad12 4->7 5->4 9 6c1aed4-6c1aede 6->9 10 6c1ad0a 6->10 11 6c1ad14-6c1ad27 7->11 12 6c1ad2c-6c1ad2f 7->12 10->7 11->12 13 6c1aec5-6c1aece 12->13 14 6c1ad35-6c1ad38 12->14 13->9 19 6c1ad64-6c1ad6d 13->19 17 6c1ad3a-6c1ad47 14->17 18 6c1ad4c-6c1ad4f 14->18 17->18 20 6c1ad51-6c1ad5a 18->20 21 6c1ad5f-6c1ad62 18->21 22 6c1ad73-6c1ad77 19->22 23 6c1aedf-6c1af16 19->23 20->21 21->19 24 6c1ad7c-6c1ad7e 21->24 22->24 31 6c1af18-6c1af1b 23->31 26 6c1ad80 24->26 27 6c1ad85-6c1ad88 24->27 26->27 27->1 29 6c1ad8e-6c1adb2 27->29 43 6c1aec2 29->43 44 6c1adb8-6c1adc7 29->44 33 6c1af21-6c1af5c 31->33 34 6c1b184-6c1b187 31->34 45 6c1af62-6c1af6e 33->45 46 6c1b14f-6c1b162 33->46 35 6c1b194-6c1b197 34->35 36 6c1b189-6c1b193 34->36 37 6c1b199-6c1b1b5 35->37 38 6c1b1ba-6c1b1bd 35->38 37->38 41 6c1b1bf-6c1b1c3 38->41 42 6c1b1ce-6c1b1d1 38->42 41->33 48 6c1b1c9 41->48 50 6c1b1e0-6c1b1e2 42->50 51 6c1b1d3 call 6c1b20a 42->51 43->13 62 6c1adc9-6c1adcf 44->62 63 6c1addf-6c1ae1a call 6c16580 44->63 57 6c1af70-6c1af89 45->57 58 6c1af8e-6c1afd2 45->58 49 6c1b164 46->49 48->42 60 6c1b165 49->60 52 6c1b1e4 50->52 53 6c1b1e9-6c1b1ec 50->53 61 6c1b1d9-6c1b1db 51->61 52->53 53->31 56 6c1b1f2-6c1b1fc 53->56 57->49 79 6c1afd4-6c1afe6 58->79 80 6c1afee-6c1b02d 58->80 60->60 61->50 64 6c1add1 62->64 65 6c1add3-6c1add5 62->65 77 6c1ae32-6c1ae49 63->77 78 6c1ae1c-6c1ae22 63->78 64->63 65->63 91 6c1ae61-6c1ae72 77->91 92 6c1ae4b-6c1ae51 77->92 81 6c1ae24 78->81 82 6c1ae26-6c1ae28 78->82 79->80 86 6c1b033-6c1b10e call 6c16580 80->86 87 6c1b114-6c1b129 80->87 81->77 82->77 86->87 87->46 99 6c1ae74-6c1ae7a 91->99 100 6c1ae8a-6c1aebb 91->100 94 6c1ae53 92->94 95 6c1ae55-6c1ae57 92->95 94->91 95->91 101 6c1ae7c 99->101 102 6c1ae7e-6c1ae80 99->102 100->43 101->100 102->100
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-3823777903
                                                                                    • Opcode ID: c941e372b85d763c750c100395a8839662cc4e219c63749ecab344e5f1c7d5ce
                                                                                    • Instruction ID: 56e11dee909670c456d521412beb40a8c693241acfbd9d25016ba71c0b2a6c23
                                                                                    • Opcode Fuzzy Hash: c941e372b85d763c750c100395a8839662cc4e219c63749ecab344e5f1c7d5ce
                                                                                    • Instruction Fuzzy Hash: 41E16F30E1120A8FCB59EFA9D5906AEB7B2EF86300F208529E405AF354DB35DD46DB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1B630 Relevance: 8.0, Strings: 6, Instructions: 468COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 254 6c1b630-6c1b650 255 6c1b652-6c1b655 254->255 256 6c1b657-6c1b65a 255->256 257 6c1b669-6c1b66c 255->257 258 6c1b664-6c1b667 256->258 259 6c1b65c-6c1b65f 256->259 260 6c1b671-6c1b674 257->260 258->257 258->260 259->258 261 6c1b686-6c1b689 260->261 262 6c1b676-6c1b681 260->262 263 6c1b68b-6c1b68f 261->263 264 6c1b6ac-6c1b6af 261->264 262->261 267 6c1b695-6c1b6a5 263->267 268 6c1b9c8-6c1b9fe 263->268 264->257 265 6c1b6b1-6c1b6b4 264->265 269 6c1b6b6-6c1b6ba 265->269 270 6c1b6db-6c1b6de 265->270 267->257 276 6c1b6a7 267->276 280 6c1ba00-6c1ba03 268->280 269->268 271 6c1b6c0-6c1b6d0 269->271 272 6c1b6e0-6c1b6e7 270->272 273 6c1b6f2-6c1b6f5 270->273 289 6c1b6d6 271->289 290 6c1b8dc-6c1b8e0 271->290 277 6c1b6ed 272->277 278 6c1b8cc-6c1b8d2 272->278 273->257 279 6c1b6fb-6c1b6fe 273->279 276->264 277->273 282 6c1b8d7-6c1b8da 278->282 283 6c1b700-6c1b705 279->283 284 6c1b708-6c1b70b 279->284 285 6c1ba05-6c1ba21 280->285 286 6c1ba26-6c1ba29 280->286 282->290 291 6c1b901-6c1b904 282->291 283->284 292 6c1b722-6c1b725 284->292 293 6c1b70d-6c1b711 284->293 285->286 287 6c1bc95-6c1bc97 286->287 288 6c1ba2f-6c1ba57 286->288 300 6c1bc99 287->300 301 6c1bc9e-6c1bca1 287->301 349 6c1ba61-6c1baa5 288->349 350 6c1ba59-6c1ba5c 288->350 289->270 290->268 302 6c1b8e6-6c1b8f6 290->302 296 6c1b906-6c1b90a 291->296 297 6c1b91b-6c1b91e 291->297 298 6c1b727-6c1b730 292->298 299 6c1b73b-6c1b73e 292->299 293->268 294 6c1b717-6c1b71d 293->294 294->292 296->268 303 6c1b910-6c1b916 296->303 306 6c1b920-6c1b929 297->306 307 6c1b93b-6c1b93e 297->307 304 6c1b736 298->304 305 6c1b87f-6c1b888 298->305 308 6c1b740-6c1b746 299->308 309 6c1b74b-6c1b74e 299->309 300->301 301->280 310 6c1bca7-6c1bcb0 301->310 302->263 325 6c1b8fc 302->325 303->297 304->299 305->268 312 6c1b88e-6c1b895 305->312 306->268 314 6c1b92f-6c1b936 306->314 315 6c1b960-6c1b963 307->315 316 6c1b940-6c1b95b 307->316 308->309 309->298 317 6c1b750-6c1b753 309->317 319 6c1b89a-6c1b89d 312->319 314->307 323 6c1b970-6c1b973 315->323 324 6c1b965-6c1b96b 315->324 316->315 320 6c1b755-6c1b771 317->320 321 6c1b776-6c1b779 317->321 326 6c1b8b4-6c1b8b7 319->326 327 6c1b89f-6c1b8a3 319->327 320->321 329 6c1b7cb-6c1b7ce 321->329 330 6c1b77b-6c1b7c6 call 6c16580 321->330 331 6c1b985-6c1b988 323->331 332 6c1b975 323->332 324->323 325->291 336 6c1b8c7-6c1b8ca 326->336 337 6c1b8b9-6c1b8c2 326->337 327->268 335 6c1b8a9-6c1b8af 327->335 340 6c1b7d0-6c1b7e5 329->340 341 6c1b80c-6c1b80f 329->341 330->329 333 6c1b992-6c1b995 331->333 334 6c1b98a-6c1b98f 331->334 343 6c1b97d-6c1b980 332->343 344 6c1b997-6c1b9a0 333->344 345 6c1b9ab-6c1b9ad 333->345 334->333 335->326 336->278 336->282 337->336 340->268 358 6c1b7eb-6c1b807 340->358 346 6c1b811-6c1b826 341->346 347 6c1b84e-6c1b851 341->347 343->331 344->306 353 6c1b9a6 344->353 354 6c1b9b4-6c1b9b7 345->354 355 6c1b9af 345->355 346->268 365 6c1b82c-6c1b849 346->365 347->344 356 6c1b857-6c1b85a 347->356 374 6c1baab-6c1bab4 349->374 375 6c1bc8a-6c1bc94 349->375 350->310 353->345 354->255 361 6c1b9bd-6c1b9c7 354->361 355->354 362 6c1b867-6c1b86a 356->362 363 6c1b85c-6c1b862 356->363 358->341 366 6c1b87a-6c1b87d 362->366 367 6c1b86c-6c1b875 362->367 363->362 365->347 366->305 366->319 367->366 376 6c1bc80-6c1bc85 374->376 377 6c1baba-6c1bb26 call 6c16580 374->377 376->375 388 6c1bc20-6c1bc35 377->388 389 6c1bb2c-6c1bb31 377->389 388->376 390 6c1bb33-6c1bb39 389->390 391 6c1bb4d 389->391 393 6c1bb3b-6c1bb3d 390->393 394 6c1bb3f-6c1bb41 390->394 395 6c1bb4f-6c1bb55 391->395 396 6c1bb4b 393->396 394->396 397 6c1bb57-6c1bb5d 395->397 398 6c1bb6a-6c1bb77 395->398 396->395 399 6c1bb63 397->399 400 6c1bc0b-6c1bc1a 397->400 405 6c1bb79-6c1bb7f 398->405 406 6c1bb8f-6c1bb9c 398->406 399->398 401 6c1bbd2-6c1bbdf 399->401 402 6c1bb9e-6c1bbab 399->402 400->388 400->389 411 6c1bbe1-6c1bbe7 401->411 412 6c1bbf7-6c1bc04 401->412 414 6c1bbc3-6c1bbd0 402->414 415 6c1bbad-6c1bbb3 402->415 409 6c1bb81 405->409 410 6c1bb83-6c1bb85 405->410 406->400 409->406 410->406 416 6c1bbe9 411->416 417 6c1bbeb-6c1bbed 411->417 412->400 414->400 418 6c1bbb5 415->418 419 6c1bbb7-6c1bbb9 415->419 416->412 417->412 418->414 419->414
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2392861976
                                                                                    • Opcode ID: 8634b4f580f09364bc5c469fffc80a91cd05e2e8af21653f20ceea1c2a0ed27d
                                                                                    • Instruction ID: fdaeffd74ec8456c7e5a46292db72ad2fc7fc6841f058d80b277b21889e2f97a
                                                                                    • Opcode Fuzzy Hash: 8634b4f580f09364bc5c469fffc80a91cd05e2e8af21653f20ceea1c2a0ed27d
                                                                                    • Instruction Fuzzy Hash: 21027D30E0020A8FDB64DB68D5906ADB7B2FB86310F10896AE405DF355DB35ED86DF91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C19120 Relevance: 5.2, Strings: 4, Instructions: 231COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 422 6c19120-6c19145 423 6c19147-6c1914a 422->423 424 6c19170-6c19173 423->424 425 6c1914c-6c1916b 423->425 426 6c19a33-6c19a35 424->426 427 6c19179-6c1918e 424->427 425->424 430 6c19a37 426->430 431 6c19a3c-6c19a3f 426->431 435 6c19190-6c19196 427->435 436 6c191a6-6c191bc 427->436 430->431 431->423 432 6c19a45-6c19a4f 431->432 437 6c19198 435->437 438 6c1919a-6c1919c 435->438 440 6c191c7-6c191c9 436->440 437->436 438->436 441 6c191e1-6c19252 440->441 442 6c191cb-6c191d1 440->442 453 6c19254-6c19277 441->453 454 6c1927e-6c1929a 441->454 443 6c191d3 442->443 444 6c191d5-6c191d7 442->444 443->441 444->441 453->454 459 6c192c6-6c192e1 454->459 460 6c1929c-6c192bf 454->460 465 6c192e3-6c19305 459->465 466 6c1930c-6c19327 459->466 460->459 465->466 471 6c19352-6c1935c 466->471 472 6c19329-6c1934b 466->472 473 6c1936c-6c193e6 471->473 474 6c1935e-6c19367 471->474 472->471 480 6c19433-6c19448 473->480 481 6c193e8-6c19406 473->481 474->432 480->426 485 6c19422-6c19431 481->485 486 6c19408-6c19417 481->486 485->480 485->481 486->485
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: 2ff2cd77758bafe926601f3dd3312cf0c721b39cb5ed4c88a939210c243a8abd
                                                                                    • Instruction ID: 6b2ebf86b74d5a51c1a3b1433bc5df175ff3addd31f42d81fba258fa89e2c6d8
                                                                                    • Opcode Fuzzy Hash: 2ff2cd77758bafe926601f3dd3312cf0c721b39cb5ed4c88a939210c243a8abd
                                                                                    • Instruction Fuzzy Hash: 21914E34F0021A9FDB54DF65D9607AFB3F6EBC9204F108569C409EB344EA74DE468B91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1CF20 Relevance: 4.6, Strings: 3, Instructions: 800COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 489 6c1cf20-6c1cf3b 491 6c1cf3d-6c1cf40 489->491 492 6c1cf42-6c1cf84 491->492 493 6c1cf89-6c1cf8c 491->493 492->493 494 6c1cfd5-6c1cfd8 493->494 495 6c1cf8e-6c1cfd0 493->495 496 6c1cfe7-6c1cfea 494->496 497 6c1cfda-6c1cfdc 494->497 495->494 501 6c1d033-6c1d036 496->501 502 6c1cfec-6c1cffb 496->502 499 6c1cfe2 497->499 500 6c1d2c7-6c1d2d0 497->500 499->496 505 6c1d2d2-6c1d2d7 500->505 506 6c1d2df-6c1d2eb 500->506 509 6c1d040-6c1d043 501->509 510 6c1d038-6c1d03d 501->510 507 6c1d00a-6c1d016 502->507 508 6c1cffd-6c1d002 502->508 505->506 513 6c1d2f1-6c1d305 506->513 514 6c1d3fc-6c1d401 506->514 515 6c1d93d-6c1d976 507->515 516 6c1d01c-6c1d02e 507->516 508->507 511 6c1d045-6c1d087 509->511 512 6c1d08c-6c1d08f 509->512 510->509 511->512 519 6c1d091-6c1d0d3 512->519 520 6c1d0d8-6c1d0db 512->520 531 6c1d409 513->531 532 6c1d30b-6c1d31d 513->532 514->531 529 6c1d978-6c1d97b 515->529 516->501 519->520 525 6c1d0dd-6c1d0f9 520->525 526 6c1d0fe-6c1d101 520->526 525->526 533 6c1d103-6c1d145 526->533 534 6c1d14a-6c1d14d 526->534 537 6c1d98a-6c1d98d 529->537 538 6c1d97d call 6c1da95 529->538 542 6c1d40c-6c1d418 531->542 561 6c1d341-6c1d343 532->561 562 6c1d31f-6c1d325 532->562 533->534 541 6c1d153-6c1d156 534->541 534->542 546 6c1d9b0-6c1d9b3 537->546 547 6c1d98f-6c1d9ab 537->547 559 6c1d983-6c1d985 538->559 549 6c1d173-6c1d176 541->549 550 6c1d158-6c1d16e 541->550 551 6c1d25c-6c1d26b 542->551 552 6c1d41e-6c1d70b 542->552 563 6c1d9b5-6c1d9e1 546->563 564 6c1d9e6-6c1d9e8 546->564 547->546 554 6c1d178-6c1d1ba 549->554 555 6c1d1bf-6c1d1c2 549->555 550->549 556 6c1d27a-6c1d286 551->556 557 6c1d26d-6c1d272 551->557 702 6c1d711-6c1d717 552->702 703 6c1d932-6c1d93c 552->703 554->555 570 6c1d1c4-6c1d206 555->570 571 6c1d20b-6c1d20e 555->571 556->515 569 6c1d28c-6c1d29e 556->569 557->556 559->537 573 6c1d34d-6c1d359 561->573 575 6c1d327 562->575 576 6c1d329-6c1d335 562->576 563->564 565 6c1d9ea 564->565 566 6c1d9ef-6c1d9f2 564->566 565->566 566->529 578 6c1d9f4-6c1da03 566->578 588 6c1d2a3-6c1d2a6 569->588 570->571 581 6c1d210-6c1d252 571->581 582 6c1d257-6c1d25a 571->582 596 6c1d367 573->596 597 6c1d35b-6c1d365 573->597 583 6c1d337-6c1d33f 575->583 576->583 604 6c1da05-6c1da68 call 6c16580 578->604 605 6c1da6a-6c1da7f 578->605 581->582 582->551 582->588 583->573 599 6c1d2b5-6c1d2b7 588->599 600 6c1d2a8-6c1d2aa 588->600 606 6c1d36c-6c1d36e 596->606 597->606 609 6c1d2b9 599->609 610 6c1d2be-6c1d2c1 599->610 600->531 608 6c1d2b0 600->608 604->605 606->531 613 6c1d374-6c1d390 call 6c16580 606->613 608->599 609->610 610->491 610->500 634 6c1d392-6c1d397 613->634 635 6c1d39f-6c1d3ab 613->635 634->635 635->514 638 6c1d3ad-6c1d3fa 635->638 638->531 704 6c1d726-6c1d72f 702->704 705 6c1d719-6c1d71e 702->705 704->515 706 6c1d735-6c1d748 704->706 705->704 708 6c1d922-6c1d92c 706->708 709 6c1d74e-6c1d754 706->709 708->702 708->703 710 6c1d763-6c1d76c 709->710 711 6c1d756-6c1d75b 709->711 710->515 712 6c1d772-6c1d793 710->712 711->710 715 6c1d7a2-6c1d7ab 712->715 716 6c1d795-6c1d79a 712->716 715->515 717 6c1d7b1-6c1d7ce 715->717 716->715 717->708 720 6c1d7d4-6c1d7da 717->720 720->515 721 6c1d7e0-6c1d7f9 720->721 723 6c1d915-6c1d91c 721->723 724 6c1d7ff-6c1d826 721->724 723->708 723->720 724->515 727 6c1d82c-6c1d836 724->727 727->515 728 6c1d83c-6c1d853 727->728 730 6c1d862-6c1d87d 728->730 731 6c1d855-6c1d860 728->731 730->723 736 6c1d883-6c1d89c call 6c16580 730->736 731->730 740 6c1d8ab-6c1d8b4 736->740 741 6c1d89e-6c1d8a3 736->741 740->515 742 6c1d8ba-6c1d90e 740->742 741->740 742->723
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q
                                                                                    • API String ID: 0-831282457
                                                                                    • Opcode ID: a65762a0b2e9f0c4e0f07400f3e0232b5851d49e1f3b8a9834dbaa902d2bf346
                                                                                    • Instruction ID: d254c9d5b36d604bd407a923691aaecda221813b1f781193a8482073c31fa27d
                                                                                    • Opcode Fuzzy Hash: a65762a0b2e9f0c4e0f07400f3e0232b5851d49e1f3b8a9834dbaa902d2bf346
                                                                                    • Instruction Fuzzy Hash: EC627130A0020A9FCB55EF68D590A5EB7F2FF85304F248A29D0199F359DB75ED4ACB81
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C14B50 Relevance: 3.9, Strings: 3, Instructions: 186COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 750 6c14b50-6c14b74 751 6c14b76-6c14b79 750->751 752 6c14b7b-6c14b95 751->752 753 6c14b9a-6c14b9d 751->753 752->753 754 6c14ba3-6c14c9b 753->754 755 6c1527c-6c1527e 753->755 773 6c14ca1-6c14cee call 6c153f8 754->773 774 6c14d1e-6c14d25 754->774 756 6c15280 755->756 757 6c15285-6c15288 755->757 756->757 757->751 760 6c1528e-6c1529b 757->760 787 6c14cf4-6c14d10 773->787 775 6c14da9-6c14db2 774->775 776 6c14d2b-6c14d9b 774->776 775->760 793 6c14da6 776->793 794 6c14d9d 776->794 791 6c14d12 787->791 792 6c14d1b-6c14d1c 787->792 791->792 792->774 793->775 794->793
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: fcq$XPcq$\Ocq
                                                                                    • API String ID: 0-3575482020
                                                                                    • Opcode ID: 13cd35bbf9e8886f2d1c3b5acaab213a3729fe58f97d9ff2ec79ed0aa512ab58
                                                                                    • Instruction ID: 9698f50cfd1516cea1795d7ab2e883311013beb8c9af906cb37f653f5f3783ed
                                                                                    • Opcode Fuzzy Hash: 13cd35bbf9e8886f2d1c3b5acaab213a3729fe58f97d9ff2ec79ed0aa512ab58
                                                                                    • Instruction Fuzzy Hash: 2A61A030F102199FEB55EFA5C8547AEBBF2FB89700F20842AD10AEB395DB748C058B41
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1910F Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1739 6c1910f-6c19118 1741 6c1917a-6c1918e 1739->1741 1742 6c1911a-6c19145 1739->1742 1748 6c19190-6c19196 1741->1748 1749 6c191a6-6c191bc 1741->1749 1745 6c19147-6c1914a 1742->1745 1746 6c19170-6c19173 1745->1746 1747 6c1914c-6c1916b 1745->1747 1750 6c19a33-6c19a35 1746->1750 1751 6c19179 1746->1751 1747->1746 1752 6c19198 1748->1752 1753 6c1919a-6c1919c 1748->1753 1759 6c191c7-6c191c9 1749->1759 1755 6c19a37 1750->1755 1756 6c19a3c-6c19a3f 1750->1756 1751->1741 1752->1749 1753->1749 1755->1756 1756->1745 1758 6c19a45-6c19a4f 1756->1758 1761 6c191e1-6c19252 1759->1761 1762 6c191cb-6c191d1 1759->1762 1773 6c19254-6c19277 1761->1773 1774 6c1927e-6c1929a 1761->1774 1763 6c191d3 1762->1763 1764 6c191d5-6c191d7 1762->1764 1763->1761 1764->1761 1773->1774 1779 6c192c6-6c192e1 1774->1779 1780 6c1929c-6c192bf 1774->1780 1785 6c192e3-6c19305 1779->1785 1786 6c1930c-6c19327 1779->1786 1780->1779 1785->1786 1791 6c19352-6c1935c 1786->1791 1792 6c19329-6c1934b 1786->1792 1793 6c1936c-6c193e6 1791->1793 1794 6c1935e-6c19367 1791->1794 1792->1791 1800 6c19433-6c19448 1793->1800 1801 6c193e8-6c19406 1793->1801 1794->1758 1800->1750 1805 6c19422-6c19431 1801->1805 1806 6c19408-6c19417 1801->1806 1805->1800 1805->1801 1806->1805
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q
                                                                                    • API String ID: 0-355816377
                                                                                    • Opcode ID: d349f5fe1986571e5e2ffe11ada2f3908931bc780308f31a6523424a6949baf4
                                                                                    • Instruction ID: ec7c692ccf16c3179231782d818b2b106a5826badbbcd57214c47c0ec1e743ff
                                                                                    • Opcode Fuzzy Hash: d349f5fe1986571e5e2ffe11ada2f3908931bc780308f31a6523424a6949baf4
                                                                                    • Instruction Fuzzy Hash: 8751B030B001069FDB54DF79D9A0B6FB3F6EBC9604F148429C80AEB384EA34DD468B91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C14B40 Relevance: 2.6, Strings: 2, Instructions: 139COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1809 6c14b40-6c14b74 1810 6c14b76-6c14b79 1809->1810 1811 6c14b7b-6c14b95 1810->1811 1812 6c14b9a-6c14b9d 1810->1812 1811->1812 1813 6c14ba3-6c14c9b 1812->1813 1814 6c1527c-6c1527e 1812->1814 1832 6c14ca1-6c14cee call 6c153f8 1813->1832 1833 6c14d1e-6c14d25 1813->1833 1815 6c15280 1814->1815 1816 6c15285-6c15288 1814->1816 1815->1816 1816->1810 1819 6c1528e-6c1529b 1816->1819 1846 6c14cf4-6c14d10 1832->1846 1834 6c14da9-6c14db2 1833->1834 1835 6c14d2b-6c14d9b 1833->1835 1834->1819 1852 6c14da6 1835->1852 1853 6c14d9d 1835->1853 1850 6c14d12 1846->1850 1851 6c14d1b-6c14d1c 1846->1851 1850->1851 1851->1833 1852->1834 1853->1852
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: fcq$XPcq
                                                                                    • API String ID: 0-936005338
                                                                                    • Opcode ID: 700693933ba82fa72970ca568c6d0816a6a0145fc23b5e742ca07be10086d259
                                                                                    • Instruction ID: cf2d9925bf999d56700740ca5a6ca5d95928c9924607a60fe6246a76e2ab82df
                                                                                    • Opcode Fuzzy Hash: 700693933ba82fa72970ca568c6d0816a6a0145fc23b5e742ca07be10086d259
                                                                                    • Instruction Fuzzy Hash: 92519D70B102199FDB05DFA5C8547AEBBF3FF89700F20852AE106AB395DA748C058B91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 013AECA8 Relevance: 1.6, APIs: 1, Instructions: 129COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1856 13aeca8-13aecc3 1857 13aeced-13aed0c call 13ae420 1856->1857 1858 13aecc5-13aecec 1856->1858 1863 13aed0e-13aed11 1857->1863 1864 13aed12-13aed71 1857->1864 1871 13aed73-13aed76 1864->1871 1872 13aed77-13aee04 GlobalMemoryStatusEx 1864->1872 1875 13aee0d-13aee35 1872->1875 1876 13aee06-13aee0c 1872->1876 1876->1875
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2874871378.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_13a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ba1cd574e388c94af2ba8ac0ffc723afcac50edc7a5d67b4a1d2c24b5c37f388
                                                                                    • Instruction ID: 1ecc53b6c37246669876a7bc35bb356a89de54d7f78ba48428a413b2436f62be
                                                                                    • Opcode Fuzzy Hash: ba1cd574e388c94af2ba8ac0ffc723afcac50edc7a5d67b4a1d2c24b5c37f388
                                                                                    • Instruction Fuzzy Hash: CD41F272D003598FCB14DFB9D8042AEBFF2EF99310F14856AE504E7251EB349845CBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 013AED90 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1879 13aed90-13aedce 1880 13aedd6-13aee04 GlobalMemoryStatusEx 1879->1880 1881 13aee0d-13aee35 1880->1881 1882 13aee06-13aee0c 1880->1882 1882->1881
                                                                                    APIs
                                                                                    • GlobalMemoryStatusEx.KERNELBASE ref: 013AEDF7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2874871378.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_13a0000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID: GlobalMemoryStatus
                                                                                    • String ID:
                                                                                    • API String ID: 1890195054-0
                                                                                    • Opcode ID: b3cae51604a91126260c2c107384dac9e322601c3005e0fe994c43dd69d732e7
                                                                                    • Instruction ID: ffddff4b63c0306949fdf201f49c66c8a13091fbc6228eca672a5d338ece05de
                                                                                    • Opcode Fuzzy Hash: b3cae51604a91126260c2c107384dac9e322601c3005e0fe994c43dd69d732e7
                                                                                    • Instruction Fuzzy Hash: B2111FB1C002699BCB10CF9AD444BDEFBF4EB48324F10812AD918A7240D378A944CFE5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1DA95 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: e07c07fc6df33bf3dcd7a6adc2783e9ae8ec187140d00fb5b5737c7fa47c34e0
                                                                                    • Instruction ID: bc50d6c4bc25b13e280fcfddb34a2556d2fc7265638b00f27f7ec8ddeed4cd96
                                                                                    • Opcode Fuzzy Hash: e07c07fc6df33bf3dcd7a6adc2783e9ae8ec187140d00fb5b5737c7fa47c34e0
                                                                                    • Instruction Fuzzy Hash: 9E41A170E0020A9FDB61DFA5D5546AEBBB2FF86300F14452AE407EB340DB74E946DB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C121BD Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: 70650568d112992961053217e8a3b4a12874add50acb26793b84853e6398f768
                                                                                    • Instruction ID: 404d2aa98f787bb11e9188b3fbe79f0283058a44d21ed84a17beef953e40f475
                                                                                    • Opcode Fuzzy Hash: 70650568d112992961053217e8a3b4a12874add50acb26793b84853e6398f768
                                                                                    • Instruction Fuzzy Hash: 7A31F034B102018FDB59AF74D61866E7BE2AB8A210F10853CD406DF395DE39DE86D7A1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C121D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: ec44f53748391fab62ced816532bee57b098f2e8d863a3bba8dc1bab13bb073e
                                                                                    • Instruction ID: abdb996f50707e1419db080beaefa717e96f5497c0bc294a354b250c0ff39dbd
                                                                                    • Opcode Fuzzy Hash: ec44f53748391fab62ced816532bee57b098f2e8d863a3bba8dc1bab13bb073e
                                                                                    • Instruction Fuzzy Hash: 0D31F034B102018FDB599F74D51866E7BE3AB8A210F20843CD406EF394DE39DE86C7A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C12348 Relevance: 1.0, Instructions: 1000COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 08791e4dd109f9dbf3194ee088a709f60e255aa4c9770f8099295e3334b6bdc3
                                                                                    • Instruction ID: 534e0c175d37a44dac66fa2a4a1a5c7b6db13acc142954464593c090105740d1
                                                                                    • Opcode Fuzzy Hash: 08791e4dd109f9dbf3194ee088a709f60e255aa4c9770f8099295e3334b6bdc3
                                                                                    • Instruction Fuzzy Hash: D9923838A002048FDB64DF68C584A5DB7F2FB46314F5484AAE459EF361DB39EE85DB80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1C160 Relevance: .6, Instructions: 642COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 120a1b80a8519ea8a51c9905335ae4ff406be99dfe0635618e2af49b721a7ebd
                                                                                    • Instruction ID: 2013fbca2aeaf7a953ec0983558f44984a486c44f60c53dac68d6c7be1a15096
                                                                                    • Opcode Fuzzy Hash: 120a1b80a8519ea8a51c9905335ae4ff406be99dfe0635618e2af49b721a7ebd
                                                                                    • Instruction Fuzzy Hash: 1132C434B402098FDB54DF68D990BAEB7B2EF8A310F108529E405EB355DB38DD46DB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C161D0 Relevance: .2, Instructions: 229COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 86087210cd81e0d97ce00a31cd803630998bf7ec9539b3f6afd53c64bff19fb3
                                                                                    • Instruction ID: edbfd4e43d1d848e3164e1ab1b44683b4e04dd57c0b8e856f7c192bf011e5caf
                                                                                    • Opcode Fuzzy Hash: 86087210cd81e0d97ce00a31cd803630998bf7ec9539b3f6afd53c64bff19fb3
                                                                                    • Instruction Fuzzy Hash: 4461A171F001214FDB55AB7EC88866FAAD7AFC5620B25443AD80EDB364EE65DD0287C2
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C14281 Relevance: .2, Instructions: 223COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e08728b0d8bc10c8a0243e1e32f0ec95197f9a6a5cf3775ee364184b7b87801a
                                                                                    • Instruction ID: b7b6c1b1780ef64adfe8e0be83e96f8ea599f5183b5c0ff49a6e759a111a05fb
                                                                                    • Opcode Fuzzy Hash: e08728b0d8bc10c8a0243e1e32f0ec95197f9a6a5cf3775ee364184b7b87801a
                                                                                    • Instruction Fuzzy Hash: D1814F34B1020A9FDB58DFA9D55466EB7F6AF89304F108429D40AEF394EB34ED428B91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C145A0 Relevance: .2, Instructions: 221COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2d8346865da475c2830172936b90ef5553219d8c4be8a4dbeb57e7b151ca4626
                                                                                    • Instruction ID: fe616a251a18e349c323f4763d2c7a82383aabcc00b733534ac9f6916c4b4c5d
                                                                                    • Opcode Fuzzy Hash: 2d8346865da475c2830172936b90ef5553219d8c4be8a4dbeb57e7b151ca4626
                                                                                    • Instruction Fuzzy Hash: B4915030E102198FDB54DF68C890B9DB7B1FF86300F20C59AD449EB295DB70AE85CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C145B8 Relevance: .2, Instructions: 210COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d395f945a47fe2b6d7e6bd44371b1fb8ef031563cff0285b41032c72a64d75ac
                                                                                    • Instruction ID: 7032d5a76fddfe301bbb930f7d4952b403b4189dd2216872c439a24633476b2a
                                                                                    • Opcode Fuzzy Hash: d395f945a47fe2b6d7e6bd44371b1fb8ef031563cff0285b41032c72a64d75ac
                                                                                    • Instruction Fuzzy Hash: 9B913D30E102198BDB64DF68C880B9DB7B1FF8A304F20C699D549AB355DB70AA85CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1EAE0 Relevance: .2, Instructions: 201COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d429e33c6a5277d6c35c57b3cf51d99360cbb94e8742efad4ec7bf525c72a627
                                                                                    • Instruction ID: 2d3f3806d19cefd7a76ad9ebd418089a141e5ab1a99abf383d0966a69095295f
                                                                                    • Opcode Fuzzy Hash: d429e33c6a5277d6c35c57b3cf51d99360cbb94e8742efad4ec7bf525c72a627
                                                                                    • Instruction Fuzzy Hash: 94715D30A002099FDB55EFA9D990A9DBBF6FF89300F148529E419EB355DB30ED46CB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1EAF0 Relevance: .2, Instructions: 201COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 13fc9c0889f1364887e89247e4e7221c0b4beb4601800c915224d7fd24386de5
                                                                                    • Instruction ID: 5ebe516c7b2865f7a68553946f206aded6ea04882cb43e2437eea94d3f0baea1
                                                                                    • Opcode Fuzzy Hash: 13fc9c0889f1364887e89247e4e7221c0b4beb4601800c915224d7fd24386de5
                                                                                    • Instruction Fuzzy Hash: 66713C30A002099FDB55EFA9D990AADBBF6FF89300F148529E409EB355DB30ED46DB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1FC59 Relevance: .2, Instructions: 176COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d2e1aad48c7da2d422a85f2429a8c48209c7a240dc1cfedf212f8d391937ed7b
                                                                                    • Instruction ID: ec567d2b9e26b00e0ff46d705181971b384644a17e20ddf64458adf7ad2afe4f
                                                                                    • Opcode Fuzzy Hash: d2e1aad48c7da2d422a85f2429a8c48209c7a240dc1cfedf212f8d391937ed7b
                                                                                    • Instruction Fuzzy Hash: 9151D131E00105DFDB64EF78E4546ADBBB2FF86315F10886EE52ADB251DB358A45CB80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1FA08 Relevance: .2, Instructions: 167COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f7f45c0417f83d3b069a78c3d1686e38712c125c8e8e4caf0dff259b5084af2a
                                                                                    • Instruction ID: 811767bc1b8b1aee951efa957f6d1267541e99fadbf4e6f0327b4a0bf84b1f2d
                                                                                    • Opcode Fuzzy Hash: f7f45c0417f83d3b069a78c3d1686e38712c125c8e8e4caf0dff259b5084af2a
                                                                                    • Instruction Fuzzy Hash: D4511C30B102189FEF60666CD96077F369ED78A310F20482FD01ADB399CA6DCD8657A2
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1FA18 Relevance: .2, Instructions: 163COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e74badb636a41e61e575a9c81a674c2ac30c73e2ff247b15156280f53b7b3e59
                                                                                    • Instruction ID: da662bb071c8dffa97a3f390d3f74e64d5f20a516c00e2f96266d83425d5fee0
                                                                                    • Opcode Fuzzy Hash: e74badb636a41e61e575a9c81a674c2ac30c73e2ff247b15156280f53b7b3e59
                                                                                    • Instruction Fuzzy Hash: F3512C30B102189FEF60666CD96477F369FD78A310F20482EE11ADB3D9CA6DCD8557A2
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C153F8 Relevance: .1, Instructions: 131COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f48e4a38e2b8f71c3562bfda2b61f1d642b8a38974b853e51814550a6ec153a2
                                                                                    • Instruction ID: 298d4832e27a207d45baad77edaf6b0f8335aea33016ab3f29de5c14f4cdf42a
                                                                                    • Opcode Fuzzy Hash: f48e4a38e2b8f71c3562bfda2b61f1d642b8a38974b853e51814550a6ec153a2
                                                                                    • Instruction Fuzzy Hash: 12417CB1E006098FDF70CEA9D880AAFFBF2FB85310F50492AE156DB254D330E9559B91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C15567 Relevance: .1, Instructions: 129COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d5a5594465835c4fff96a6b157780785c0e070bdf1ba5f727e8830cde92f7482
                                                                                    • Instruction ID: 073fd629841e4bc174b72c7eaba3d81979793f51797e927983229dac42ab705c
                                                                                    • Opcode Fuzzy Hash: d5a5594465835c4fff96a6b157780785c0e070bdf1ba5f727e8830cde92f7482
                                                                                    • Instruction Fuzzy Hash: C64192B5E101098FDF60CB69C4C0ABEBBB1EB86310FA1896ED059DF251C634DA41DBD1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C12080 Relevance: .1, Instructions: 95COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a85a9bf2fa588654090d8e2b4e44e8f8c907d3f53edb1727d689ec9e40f8f69a
                                                                                    • Instruction ID: 9eb62c68d29cf3799a60bb6af71bc6845fb426a6b8cbf82b95d7d5608b4dd136
                                                                                    • Opcode Fuzzy Hash: a85a9bf2fa588654090d8e2b4e44e8f8c907d3f53edb1727d689ec9e40f8f69a
                                                                                    • Instruction Fuzzy Hash: C8318C35E102559FCF45DF64D89469EB7B2BF8A300F208529E906AB340DB75EE86CB40
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C12090 Relevance: .1, Instructions: 91COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ec23a69836a491f2bdc51fb602541077460ff59e7db9901b24ae469f90512291
                                                                                    • Instruction ID: 19775e49773dfa119496e86ffc0a7f187ca6e9d703cd87f388e2f5b48ddffe7e
                                                                                    • Opcode Fuzzy Hash: ec23a69836a491f2bdc51fb602541077460ff59e7db9901b24ae469f90512291
                                                                                    • Instruction Fuzzy Hash: FF317C35E102199FCF45DFA5D85469EB7B2BF8A300F208529E906EB340DB75EE86CB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13A81 Relevance: .1, Instructions: 82COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: eef43555bfdbccd3580ed3332f2445ce132bebc16f5edeb0aef8d287c75b8c28
                                                                                    • Instruction ID: 4eca959dc6017549f901946680587c5753a282a97109703bc7cc9135460299da
                                                                                    • Opcode Fuzzy Hash: eef43555bfdbccd3580ed3332f2445ce132bebc16f5edeb0aef8d287c75b8c28
                                                                                    • Instruction Fuzzy Hash: 8C219179F102059FDB50CF78D940AAEBBF5EB48714F108039E909EB340EB34D9018B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13A90 Relevance: .1, Instructions: 78COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 753b595b1c1fa495036dad9a0bf1e2b3657a6ff3b11d9b030a8137f9a2ceadf5
                                                                                    • Instruction ID: e15ba82094f38d74b1a0aaf3f128b661b6ffe8aa1208edd5add1cca8c31d3c46
                                                                                    • Opcode Fuzzy Hash: 753b595b1c1fa495036dad9a0bf1e2b3657a6ff3b11d9b030a8137f9a2ceadf5
                                                                                    • Instruction Fuzzy Hash: 39217C75E102159FDB40CFA9D980AAEB7F5EB88714F108039EA09EB350EB34DD018B94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C16CE0 Relevance: .1, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: c26fee812273e8eba8e4e2217d15c5bab56c11ace45b7272b4f377d29f8d41c6
                                                                                    • Instruction ID: 6efbce8a9a1d9edc7143f7d01a0ae50490609305b5d4a3fb392c3771ca5a378e
                                                                                    • Opcode Fuzzy Hash: c26fee812273e8eba8e4e2217d15c5bab56c11ace45b7272b4f377d29f8d41c6
                                                                                    • Instruction Fuzzy Hash: 1A21D130B11119AFDF54EB69E8506AEB7B7EB85250F208429E409EF340DB31ED428BD0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0121D044 Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2872488063.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_121d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e6130d4a1bc7ad0da8ddb2662a610b2b9d04dc0a7dd99b8465fc4d22afe68052
                                                                                    • Instruction ID: 92e8296dd2cfb31b443e22731f73508ddcd759682c81908fb5867f27f6719371
                                                                                    • Opcode Fuzzy Hash: e6130d4a1bc7ad0da8ddb2662a610b2b9d04dc0a7dd99b8465fc4d22afe68052
                                                                                    • Instruction Fuzzy Hash: BD217671110208DFCB01DF68C9C8B26BBE1FB94314F20C6ADE9494B35AC77BD846CA61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C16CF0 Relevance: .1, Instructions: 68COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f7195c053b936dec95ec91a0b0f08b2650a2ff2223171030a1d8f8c29f8a5de0
                                                                                    • Instruction ID: be42f45ddb35794532d874c65275c2bad089fadf7cc0c95f01d47164dc86da9f
                                                                                    • Opcode Fuzzy Hash: f7195c053b936dec95ec91a0b0f08b2650a2ff2223171030a1d8f8c29f8a5de0
                                                                                    • Instruction Fuzzy Hash: 7121D331B101199FDF54EB6AE9506AEB7B7EB85310F248439E409EF344EB31ED428B94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13BA0 Relevance: .1, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4b2a1bbfae963d9f5e6fd4364b08869dfda72a240cc63bff157a443c4629560e
                                                                                    • Instruction ID: 2b3b4a0dac773ca9e10f738013f2790c1f9aeca9cf796293e41598beaa9e962f
                                                                                    • Opcode Fuzzy Hash: 4b2a1bbfae963d9f5e6fd4364b08869dfda72a240cc63bff157a443c4629560e
                                                                                    • Instruction Fuzzy Hash: A111A131B141259FDF54AA68DC14AAF73AAEBC9314B00453AD40EEB340EE24DC029BD1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C141E2 Relevance: .1, Instructions: 55COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: c510cc9291977010a53c19668f97adcf767ec57ebb1ee1c00ec2e5ef89e6381b
                                                                                    • Instruction ID: 89f088121391c68652aa05d52baaebef666ca1c405daed7ccf4a9b01c30704d9
                                                                                    • Opcode Fuzzy Hash: c510cc9291977010a53c19668f97adcf767ec57ebb1ee1c00ec2e5ef89e6381b
                                                                                    • Instruction Fuzzy Hash: 9C01B131B000105FDB69A6BDA814B2BB6DBDBCA714F24C43DE50ACB385D925DD434395
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13858 Relevance: .1, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 10a8852ebe2ace9fcd7c28944a524c692e2246993889fabe5c1d552a100d85ab
                                                                                    • Instruction ID: 11db7a6bc55d97a8199507f47ab534aa0669a1c65409f51029bfe8e085978aca
                                                                                    • Opcode Fuzzy Hash: 10a8852ebe2ace9fcd7c28944a524c692e2246993889fabe5c1d552a100d85ab
                                                                                    • Instruction Fuzzy Hash: 5621F4B1D01259EFCB10CF9AD884ACEFFB4FB49314F10812AE918A7200C374A554CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0121D03F Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2872488063.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_121d000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction ID: 2f87737d2e98228e6872e0ed2cae01cb29633b5f292037ed3f91154e00106dbc
                                                                                    • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction Fuzzy Hash: 8111D075504244CFDB12CF64C5C8B15BFA1FB44314F24C6A9D9494B256C33AD44ACF51
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1A2D8 Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 8f50fec5f766efe56907bd07457d39669f377f5efc607372265d7f56b412dd15
                                                                                    • Instruction ID: ce59bbdd75e3acc6ad0f26b4cf394d95439c7cc00064f71f149c37c8b2f5f530
                                                                                    • Opcode Fuzzy Hash: 8f50fec5f766efe56907bd07457d39669f377f5efc607372265d7f56b412dd15
                                                                                    • Instruction Fuzzy Hash: 18017170B104111FD765EA69E96072A77D7EB8B610F10843DE50ECB381EA66DE034391
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1ED61 Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 328f6d193f544a9aeb96a4c07f481cb867b063c0200b180f1b2975a855b6e4ff
                                                                                    • Instruction ID: 9abd51a0d6d1aebb970ca8efb336e90a843a7108b48ced1177e03833998424c4
                                                                                    • Opcode Fuzzy Hash: 328f6d193f544a9aeb96a4c07f481cb867b063c0200b180f1b2975a855b6e4ff
                                                                                    • Instruction Fuzzy Hash: 4F01DF31B101201FCB65EA3D9850B2F77DBEBCA610F24843DF50ACB344DA21DD028395
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13860 Relevance: .1, Instructions: 52COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5558db20e49ab1dbfcdc81c62a0fbf07b78e133793ceddfc3cfcd9f9d6201228
                                                                                    • Instruction ID: fac8dcfe7d607351ee1933df95880c37ba3477f499d245135ae4075249cd60de
                                                                                    • Opcode Fuzzy Hash: 5558db20e49ab1dbfcdc81c62a0fbf07b78e133793ceddfc3cfcd9f9d6201228
                                                                                    • Instruction Fuzzy Hash: A011D3B1D01259AFCB00DF9AD884BDEFFB4FB49314F10812AE918A7240C374A944CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C13B8F Relevance: .1, Instructions: 51COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ac6b0ea70ce0a905aa00cd2a81986e5a82037f4cebf717609c3fcd6436940fb4
                                                                                    • Instruction ID: 4f0e1de08436fe8efbc00a33a69c7828064dd4007716f0d6fc3e1035ba94b8fd
                                                                                    • Opcode Fuzzy Hash: ac6b0ea70ce0a905aa00cd2a81986e5a82037f4cebf717609c3fcd6436940fb4
                                                                                    • Instruction Fuzzy Hash: D3018F76B141259FEF54DA699D206EF36ABDBC9314F04413ED90EEB280EE648C0397D1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C141F0 Relevance: .1, Instructions: 51COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 583fccce17fca3cc540f443468d61b31b660874b706c8434ac6de61fc7339d41
                                                                                    • Instruction ID: 24de5fb723680a78341edb2907b0300a2d882a5e5592bdae6607f479bc5a657a
                                                                                    • Opcode Fuzzy Hash: 583fccce17fca3cc540f443468d61b31b660874b706c8434ac6de61fc7339d41
                                                                                    • Instruction Fuzzy Hash: FF016D31B100201FDB69A6ADE854B2BB2DADBCA711F24C43DE50ECB344DA65DE434395
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1ED70 Relevance: .0, Instructions: 49COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: dc7359a79877be26e074539f7c3fc4ab912a2dd205dd446b68b4a9769336ebb4
                                                                                    • Instruction ID: d00a036c64db3c712589481368da4cc3d20f65676ae1268d7d85537f484b613e
                                                                                    • Opcode Fuzzy Hash: dc7359a79877be26e074539f7c3fc4ab912a2dd205dd446b68b4a9769336ebb4
                                                                                    • Instruction Fuzzy Hash: 62016931B105201FCBA5A66D985472E62DADBCAA24F24882DFA0ACB344DA21DD024385
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1A2E8 Relevance: .0, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 18b6178ed08411ed5506eaa9dd5befe5b093d59ce4ac2db1211cfdc4d6068007
                                                                                    • Instruction ID: 247e9ffeed8299c22211b7575bcddb8b1c31fa429727df242194b1995b92d2fc
                                                                                    • Opcode Fuzzy Hash: 18b6178ed08411ed5506eaa9dd5befe5b093d59ce4ac2db1211cfdc4d6068007
                                                                                    • Instruction Fuzzy Hash: 2F018130B100114FDB55EABDD95072E73D6EB8A710F10843DE60ECB341EA25EE034385
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C16451 Relevance: .0, Instructions: 26COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d7e27f76b43f5f99f9b0063128850b63468ae18659c7f2c08f2c005026e7e331
                                                                                    • Instruction ID: bf20369c438f414d5fa55e5f973fd6cb9c3fd3b19decbaf7f65fa9c35d78bac5
                                                                                    • Opcode Fuzzy Hash: d7e27f76b43f5f99f9b0063128850b63468ae18659c7f2c08f2c005026e7e331
                                                                                    • Instruction Fuzzy Hash: 94E092B1A193486FDB50CA75C90564A7A6E9703218F1045A9D504CB242E236CE51A391
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    Function 06C17678 Relevance: 13.0, Strings: 10, Instructions: 468COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2222239885
                                                                                    • Opcode ID: 9b45b39a13a2b083d0a155440a9faaac854f08b2179566afcae58abb44929cdc
                                                                                    • Instruction ID: 1c598c7175daacb499d45ae88f790639dd0df32e7294a21934d741767b644e83
                                                                                    • Opcode Fuzzy Hash: 9b45b39a13a2b083d0a155440a9faaac854f08b2179566afcae58abb44929cdc
                                                                                    • Instruction Fuzzy Hash: 0C120A30E002198FDB68DF69C954A9EB7F2FF89304F2085A9D409AB354DB359D86CF91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1A910 Relevance: 10.2, Strings: 8, Instructions: 229COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-3823777903
                                                                                    • Opcode ID: 178d81e0a3ed49df70095e1787a3b84535a86fad6eba3bc07e17ba6f1612eb6d
                                                                                    • Instruction ID: 37c95a376ae6a637f3b31e18e9eb42a41cdc46e69bcf23e85b5829e5828e4803
                                                                                    • Opcode Fuzzy Hash: 178d81e0a3ed49df70095e1787a3b84535a86fad6eba3bc07e17ba6f1612eb6d
                                                                                    • Instruction Fuzzy Hash: C0917E30E0120ADFDB68EFA9DA94B6E77B2EF85300F108529E405AF394DB359D45DB90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C17078 Relevance: 9.2, Strings: 7, Instructions: 405COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-390881366
                                                                                    • Opcode ID: 3387f52feabb8cada0287ab62e0d682cbb82d195cd992f84340f913c59b8cde4
                                                                                    • Instruction ID: 43956e0d7943dc9ea6f7dff43bf7f4469b5bc59cb5b574248976ab48eea1c957
                                                                                    • Opcode Fuzzy Hash: 3387f52feabb8cada0287ab62e0d682cbb82d195cd992f84340f913c59b8cde4
                                                                                    • Instruction Fuzzy Hash: F6F13A34A00209CFDB59EF69C594A6EB7B3FF89304F608568D405AB368DB35ED86CB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C183A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: afe1e122ddea1ec9993aa3042cdf3bc8717bf00263d1a89c4a0c0759256217d1
                                                                                    • Instruction ID: dcd2c536ec53fcd20d10afa123c96556cb45fd0495e1cbf46fd6cdb26f649de1
                                                                                    • Opcode Fuzzy Hash: afe1e122ddea1ec9993aa3042cdf3bc8717bf00263d1a89c4a0c0759256217d1
                                                                                    • Instruction Fuzzy Hash: C0B14C30E112098FDB58EF69D5946AEB7B2EF85300F248929E406EF355DB35DD86CB80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C187C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: LR^q$LR^q$$^q$$^q
                                                                                    • API String ID: 0-2454687669
                                                                                    • Opcode ID: c42b9d4c5b47831ff8ff4a8b127bd525ba0797b222cf10dd803dde689f43df41
                                                                                    • Instruction ID: d3835c3c4cf03c9195462a789ce5b5fda972d291dab12273b9ed2ba76b5af105
                                                                                    • Opcode Fuzzy Hash: c42b9d4c5b47831ff8ff4a8b127bd525ba0797b222cf10dd803dde689f43df41
                                                                                    • Instruction Fuzzy Hash: A851D430B012059FDB58EF29C950A6AB7E6FF85304F10856DE4069F395DB70ED45CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C1AC9A Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000009.00000002.2894502210.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_9_2_6c10000_45brrQrxwH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: 9ad9f72e78d4940de3d8758c172d14d61b32411ee8c8157dacba47f6edef65b1
                                                                                    • Instruction ID: a1b3e8f9d63f034c174d55c7b6a57f77e22abd23b31e9884d403bfca3f5860d9
                                                                                    • Opcode Fuzzy Hash: 9ad9f72e78d4940de3d8758c172d14d61b32411ee8c8157dacba47f6edef65b1
                                                                                    • Instruction Fuzzy Hash: 88519130E122099FDB69EFA8D5805AEB3B2EF8A300F108529D405DF354DB31DE41DB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Execution Graph

                                                                                    Execution Coverage:11.5%
                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                    Signature Coverage:0%
                                                                                    Total number of Nodes:210
                                                                                    Total number of Limit Nodes:6
                                                                                    execution_graph 23229 746aca0 23230 746ae2b 23229->23230 23232 746acc6 23229->23232 23232->23230 23233 7468360 23232->23233 23234 746af20 PostMessageW 23233->23234 23235 746af8c 23234->23235 23235->23232 23208 2b04668 23209 2b0467a 23208->23209 23210 2b04686 23209->23210 23212 2b04778 23209->23212 23213 2b0479d 23212->23213 23217 2b04878 23213->23217 23221 2b04888 23213->23221 23219 2b04888 23217->23219 23218 2b0498c 23218->23218 23219->23218 23225 2b0449c 23219->23225 23223 2b048af 23221->23223 23222 2b0498c 23223->23222 23224 2b0449c CreateActCtxA 23223->23224 23224->23222 23226 2b05918 CreateActCtxA 23225->23226 23228 2b059cf 23226->23228 23236 2b0ad98 23240 2b0ae90 23236->23240 23250 2b0ae7f 23236->23250 23237 2b0ada7 23241 2b0aea1 23240->23241 23244 2b0aec4 23240->23244 23260 2b09898 23241->23260 23244->23237 23245 2b0aebc 23245->23244 23246 2b0b0c8 GetModuleHandleW 23245->23246 23247 2b0b0f5 23246->23247 23247->23237 23251 2b0aea1 23250->23251 23254 2b0aec4 23250->23254 23252 2b09898 GetModuleHandleW 23251->23252 23253 2b0aeac 23252->23253 23253->23254 23258 2b0b128 2 API calls 23253->23258 23259 2b0b118 2 API calls 23253->23259 23254->23237 23255 2b0aebc 23255->23254 23256 2b0b0c8 GetModuleHandleW 23255->23256 23257 2b0b0f5 23256->23257 23257->23237 23258->23255 23259->23255 23261 2b0b080 GetModuleHandleW 23260->23261 23263 2b0aeac 23261->23263 23263->23244 23264 2b0b128 23263->23264 23269 2b0b118 23263->23269 23265 2b09898 GetModuleHandleW 23264->23265 23266 2b0b13c 23265->23266 23268 2b0b161 23266->23268 23275 2b0a8d0 23266->23275 23268->23245 23270 2b0b128 23269->23270 23271 2b09898 GetModuleHandleW 23270->23271 23272 2b0b13c 23271->23272 23273 2b0a8d0 LoadLibraryExW 23272->23273 23274 2b0b161 23272->23274 23273->23274 23274->23245 23276 2b0b308 LoadLibraryExW 23275->23276 23278 2b0b381 23276->23278 23278->23268 23279 2b0d118 23280 2b0d15e 23279->23280 23284 2b0d2f8 23280->23284 23287 2b0d2e9 23280->23287 23281 2b0d24b 23291 2b0ca00 23284->23291 23288 2b0d2f8 23287->23288 23289 2b0ca00 DuplicateHandle 23288->23289 23290 2b0d326 23289->23290 23290->23281 23292 2b0d360 DuplicateHandle 23291->23292 23293 2b0d326 23292->23293 23293->23281 23294 74679ed 23299 7469b66 23294->23299 23317 7469af0 23294->23317 23334 7469b00 23294->23334 23295 74679fc 23300 7469af4 23299->23300 23302 7469b69 23299->23302 23301 7469b22 23300->23301 23351 746a161 23300->23351 23356 746a119 23300->23356 23361 746a2ba 23300->23361 23366 746a33d 23300->23366 23370 746a1f1 23300->23370 23374 746a0b0 23300->23374 23379 7469e32 23300->23379 23388 746a1d5 23300->23388 23397 746a054 23300->23397 23402 746a3ad 23300->23402 23407 746a26d 23300->23407 23416 746a6af 23300->23416 23422 746a60e 23300->23422 23427 746a18e 23300->23427 23301->23295 23302->23295 23318 7469b1a 23317->23318 23319 7469b22 23318->23319 23320 746a161 2 API calls 23318->23320 23321 746a18e 2 API calls 23318->23321 23322 746a60e 2 API calls 23318->23322 23323 746a6af 2 API calls 23318->23323 23324 746a26d 4 API calls 23318->23324 23325 746a3ad 2 API calls 23318->23325 23326 746a054 2 API calls 23318->23326 23327 746a1d5 4 API calls 23318->23327 23328 7469e32 4 API calls 23318->23328 23329 746a0b0 2 API calls 23318->23329 23330 746a1f1 2 API calls 23318->23330 23331 746a33d 2 API calls 23318->23331 23332 746a2ba 2 API calls 23318->23332 23333 746a119 2 API calls 23318->23333 23319->23295 23320->23319 23321->23319 23322->23319 23323->23319 23324->23319 23325->23319 23326->23319 23327->23319 23328->23319 23329->23319 23330->23319 23331->23319 23332->23319 23333->23319 23335 7469b1a 23334->23335 23336 7469b22 23335->23336 23337 746a161 2 API calls 23335->23337 23338 746a18e 2 API calls 23335->23338 23339 746a60e 2 API calls 23335->23339 23340 746a6af 2 API calls 23335->23340 23341 746a26d 4 API calls 23335->23341 23342 746a3ad 2 API calls 23335->23342 23343 746a054 2 API calls 23335->23343 23344 746a1d5 4 API calls 23335->23344 23345 7469e32 4 API calls 23335->23345 23346 746a0b0 2 API calls 23335->23346 23347 746a1f1 2 API calls 23335->23347 23348 746a33d 2 API calls 23335->23348 23349 746a2ba 2 API calls 23335->23349 23350 746a119 2 API calls 23335->23350 23336->23295 23337->23336 23338->23336 23339->23336 23340->23336 23341->23336 23342->23336 23343->23336 23344->23336 23345->23336 23346->23336 23347->23336 23348->23336 23349->23336 23350->23336 23352 746a457 23351->23352 23431 74670e2 23352->23431 23435 74670e8 23352->23435 23353 746a472 23353->23301 23357 746a11f 23356->23357 23439 7467278 23357->23439 23443 7467280 23357->23443 23358 746a141 23362 746a05d 23361->23362 23364 7467280 WriteProcessMemory 23362->23364 23365 7467278 WriteProcessMemory 23362->23365 23363 746a0f4 23363->23301 23364->23363 23365->23363 23447 7467370 23366->23447 23451 7467369 23366->23451 23367 746a363 23367->23301 23371 746a191 23370->23371 23371->23370 23372 74670e2 Wow64SetThreadContext 23371->23372 23373 74670e8 Wow64SetThreadContext 23371->23373 23372->23371 23373->23371 23375 746a0d7 23374->23375 23377 7467280 WriteProcessMemory 23375->23377 23378 7467278 WriteProcessMemory 23375->23378 23376 746a7a1 23377->23376 23378->23376 23381 7469e73 23379->23381 23380 7469f5f 23380->23301 23381->23380 23455 74674fd 23381->23455 23459 7467508 23381->23459 23382 746a02e 23384 7467280 WriteProcessMemory 23382->23384 23385 7467278 WriteProcessMemory 23382->23385 23383 746a0f4 23383->23301 23384->23383 23385->23383 23389 746a271 23388->23389 23463 74671c0 23389->23463 23467 74671b8 23389->23467 23390 746a5b9 23390->23301 23391 746a0f4 23391->23301 23392 746a05d 23392->23390 23395 7467280 WriteProcessMemory 23392->23395 23396 7467278 WriteProcessMemory 23392->23396 23395->23391 23396->23391 23398 746a05d 23397->23398 23400 7467280 WriteProcessMemory 23398->23400 23401 7467278 WriteProcessMemory 23398->23401 23399 746a0f4 23399->23301 23400->23399 23401->23399 23403 746a05d 23402->23403 23403->23402 23405 7467280 WriteProcessMemory 23403->23405 23406 7467278 WriteProcessMemory 23403->23406 23404 746a0f4 23404->23301 23405->23404 23406->23404 23408 746a271 23407->23408 23412 74671c0 VirtualAllocEx 23408->23412 23413 74671b8 VirtualAllocEx 23408->23413 23409 746a5b9 23409->23301 23410 746a0f4 23410->23301 23411 746a05d 23411->23409 23414 7467280 WriteProcessMemory 23411->23414 23415 7467278 WriteProcessMemory 23411->23415 23412->23411 23413->23411 23414->23410 23415->23410 23417 746a625 23416->23417 23418 746a6bc 23416->23418 23471 7467030 23417->23471 23475 7467038 23417->23475 23419 746a63a 23423 746a614 23422->23423 23425 7467030 ResumeThread 23423->23425 23426 7467038 ResumeThread 23423->23426 23424 746a63a 23425->23424 23426->23424 23428 746a191 23427->23428 23429 74670e2 Wow64SetThreadContext 23428->23429 23430 74670e8 Wow64SetThreadContext 23428->23430 23429->23428 23430->23428 23432 746712d Wow64SetThreadContext 23431->23432 23434 7467175 23432->23434 23434->23353 23436 746712d Wow64SetThreadContext 23435->23436 23438 7467175 23436->23438 23438->23353 23440 74672c8 WriteProcessMemory 23439->23440 23442 746731f 23440->23442 23442->23358 23444 74672c8 WriteProcessMemory 23443->23444 23446 746731f 23444->23446 23446->23358 23448 74673bb ReadProcessMemory 23447->23448 23450 74673ff 23448->23450 23450->23367 23452 74673bb ReadProcessMemory 23451->23452 23454 74673ff 23452->23454 23454->23367 23456 7467591 CreateProcessA 23455->23456 23458 7467753 23456->23458 23460 7467591 CreateProcessA 23459->23460 23462 7467753 23460->23462 23464 7467200 VirtualAllocEx 23463->23464 23466 746723d 23464->23466 23466->23392 23468 7467200 VirtualAllocEx 23467->23468 23470 746723d 23468->23470 23470->23392 23472 7467078 ResumeThread 23471->23472 23474 74670a9 23472->23474 23474->23419 23476 7467078 ResumeThread 23475->23476 23478 74670a9 23476->23478 23478->23419

                                                                                    Executed Functions

                                                                                    Function 074674FD Relevance: 1.7, APIs: 1, Instructions: 245processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 381 74674fd-746759d 383 74675d6-74675f6 381->383 384 746759f-74675a9 381->384 391 746762f-746765e 383->391 392 74675f8-7467602 383->392 384->383 385 74675ab-74675ad 384->385 386 74675d0-74675d3 385->386 387 74675af-74675b9 385->387 386->383 389 74675bd-74675cc 387->389 390 74675bb 387->390 389->389 394 74675ce 389->394 390->389 400 7467697-7467751 CreateProcessA 391->400 401 7467660-746766a 391->401 392->391 393 7467604-7467606 392->393 395 7467608-7467612 393->395 396 7467629-746762c 393->396 394->386 398 7467616-7467625 395->398 399 7467614 395->399 396->391 398->398 402 7467627 398->402 399->398 412 7467753-7467759 400->412 413 746775a-74677e0 400->413 401->400 403 746766c-746766e 401->403 402->396 405 7467670-746767a 403->405 406 7467691-7467694 403->406 407 746767e-746768d 405->407 408 746767c 405->408 406->400 407->407 410 746768f 407->410 408->407 410->406 412->413 423 74677e2-74677e6 413->423 424 74677f0-74677f4 413->424 423->424 425 74677e8 423->425 426 74677f6-74677fa 424->426 427 7467804-7467808 424->427 425->424 426->427 428 74677fc 426->428 429 746780a-746780e 427->429 430 7467818-746781c 427->430 428->427 429->430 433 7467810 429->433 431 746782e-7467835 430->431 432 746781e-7467824 430->432 434 7467837-7467846 431->434 435 746784c 431->435 432->431 433->430 434->435 437 746784d 435->437 437->437
                                                                                    APIs
                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0746773E
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: 083833fc05653949347675621e7ae535e8fc9b6fbe9bd3291ca0e5980f7eb721
                                                                                    • Instruction ID: ac5a026a29c45fb6da9f30c16cbd3821dfb52639847198c8d6c744892e1ff0be
                                                                                    • Opcode Fuzzy Hash: 083833fc05653949347675621e7ae535e8fc9b6fbe9bd3291ca0e5980f7eb721
                                                                                    • Instruction Fuzzy Hash: ACA17DB1D0021ADFDF21CF68C845BEEBBB2BF44314F1485AAD849A7250DB749985CF92
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467508 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 438 7467508-746759d 440 74675d6-74675f6 438->440 441 746759f-74675a9 438->441 448 746762f-746765e 440->448 449 74675f8-7467602 440->449 441->440 442 74675ab-74675ad 441->442 443 74675d0-74675d3 442->443 444 74675af-74675b9 442->444 443->440 446 74675bd-74675cc 444->446 447 74675bb 444->447 446->446 451 74675ce 446->451 447->446 457 7467697-7467751 CreateProcessA 448->457 458 7467660-746766a 448->458 449->448 450 7467604-7467606 449->450 452 7467608-7467612 450->452 453 7467629-746762c 450->453 451->443 455 7467616-7467625 452->455 456 7467614 452->456 453->448 455->455 459 7467627 455->459 456->455 469 7467753-7467759 457->469 470 746775a-74677e0 457->470 458->457 460 746766c-746766e 458->460 459->453 462 7467670-746767a 460->462 463 7467691-7467694 460->463 464 746767e-746768d 462->464 465 746767c 462->465 463->457 464->464 467 746768f 464->467 465->464 467->463 469->470 480 74677e2-74677e6 470->480 481 74677f0-74677f4 470->481 480->481 482 74677e8 480->482 483 74677f6-74677fa 481->483 484 7467804-7467808 481->484 482->481 483->484 485 74677fc 483->485 486 746780a-746780e 484->486 487 7467818-746781c 484->487 485->484 486->487 490 7467810 486->490 488 746782e-7467835 487->488 489 746781e-7467824 487->489 491 7467837-7467846 488->491 492 746784c 488->492 489->488 490->487 491->492 494 746784d 492->494 494->494
                                                                                    APIs
                                                                                    • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0746773E
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: 7e5f6058aac9daaf852dd063180fb6ab099eb1181dc1e126922b1fb7d6dfde97
                                                                                    • Instruction ID: 051b68b613eadb4a05cdad825c1362da7064f461cfc79979cd8be7d452fc9eba
                                                                                    • Opcode Fuzzy Hash: 7e5f6058aac9daaf852dd063180fb6ab099eb1181dc1e126922b1fb7d6dfde97
                                                                                    • Instruction Fuzzy Hash: 89916DB1D0021ADFDF11CF68C845BEEBBB2BF44314F1485AAE808A7250DB749985CF92
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0AE90 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 495 2b0ae90-2b0ae9f 496 2b0aea1-2b0aeae call 2b09898 495->496 497 2b0aecb-2b0aecf 495->497 503 2b0aeb0 496->503 504 2b0aec4 496->504 499 2b0aed1-2b0aedb 497->499 500 2b0aee3-2b0af24 497->500 499->500 506 2b0af31-2b0af3f 500->506 507 2b0af26-2b0af2e 500->507 550 2b0aeb6 call 2b0b128 503->550 551 2b0aeb6 call 2b0b118 503->551 504->497 508 2b0af41-2b0af46 506->508 509 2b0af63-2b0af65 506->509 507->506 511 2b0af51 508->511 512 2b0af48-2b0af4f call 2b0a874 508->512 514 2b0af68-2b0af6f 509->514 510 2b0aebc-2b0aebe 510->504 513 2b0b000-2b0b0c0 510->513 516 2b0af53-2b0af61 511->516 512->516 545 2b0b0c2-2b0b0c5 513->545 546 2b0b0c8-2b0b0f3 GetModuleHandleW 513->546 517 2b0af71-2b0af79 514->517 518 2b0af7c-2b0af83 514->518 516->514 517->518 519 2b0af90-2b0af92 call 2b0a884 518->519 520 2b0af85-2b0af8d 518->520 524 2b0af97-2b0af99 519->524 520->519 526 2b0afa6-2b0afab 524->526 527 2b0af9b-2b0afa3 524->527 528 2b0afc9-2b0afd6 526->528 529 2b0afad-2b0afb4 526->529 527->526 536 2b0afd8-2b0aff6 528->536 537 2b0aff9-2b0afff 528->537 529->528 531 2b0afb6-2b0afc6 call 2b0a894 call 2b0a8a4 529->531 531->528 536->537 545->546 547 2b0b0f5-2b0b0fb 546->547 548 2b0b0fc-2b0b110 546->548 547->548 550->510 551->510
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleModule
                                                                                    • String ID:
                                                                                    • API String ID: 4139908857-0
                                                                                    • Opcode ID: 513cd4e5dd22796496c7216359f8d2d33aee06d889d941d4a49a1adb235c1e30
                                                                                    • Instruction ID: 8ac559b3468d999913d6d49f291ae7226700f463925fc596ad17ab6da269525f
                                                                                    • Opcode Fuzzy Hash: 513cd4e5dd22796496c7216359f8d2d33aee06d889d941d4a49a1adb235c1e30
                                                                                    • Instruction Fuzzy Hash: C87138B0A00B058FDB25DF29D19075ABBF2FF48304F108A6DD186D7A90DB75E945CB94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 552 2b0449c-2b059d9 CreateActCtxA 555 2b059e2-2b05a3c 552->555 556 2b059db-2b059e1 552->556 563 2b05a4b-2b05a4f 555->563 564 2b05a3e-2b05a41 555->564 556->555 565 2b05a60-2b05a90 563->565 566 2b05a51-2b05a5d 563->566 564->563 570 2b05a42-2b05a4a 565->570 571 2b05a92-2b05b14 565->571 566->565 570->563 574 2b059cf-2b059d9 570->574 574->555 574->556
                                                                                    APIs
                                                                                    • CreateActCtxA.KERNEL32(?), ref: 02B059C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Create
                                                                                    • String ID:
                                                                                    • API String ID: 2289755597-0
                                                                                    • Opcode ID: 66a202436cc987cac75adf666a55dd3d875bbb0878a24753fd1f0529004a0c97
                                                                                    • Instruction ID: 98948c3e8c177740550d5143635d00c284b3249a12368fb9bca92c196636d4ec
                                                                                    • Opcode Fuzzy Hash: 66a202436cc987cac75adf666a55dd3d875bbb0878a24753fd1f0529004a0c97
                                                                                    • Instruction Fuzzy Hash: CF41E3B0C0071DCFDB24DFA9C98479DBBB5BF48304F6480AAD409AB255DB756945CF90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0590C Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 575 2b0590c-2b05914 576 2b0591c-2b059d9 CreateActCtxA 575->576 578 2b059e2-2b05a3c 576->578 579 2b059db-2b059e1 576->579 586 2b05a4b-2b05a4f 578->586 587 2b05a3e-2b05a41 578->587 579->578 588 2b05a60-2b05a90 586->588 589 2b05a51-2b05a5d 586->589 587->586 593 2b05a42-2b05a4a 588->593 594 2b05a92-2b05b14 588->594 589->588 593->586 597 2b059cf-2b059d9 593->597 597->578 597->579
                                                                                    APIs
                                                                                    • CreateActCtxA.KERNEL32(?), ref: 02B059C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: Create
                                                                                    • String ID:
                                                                                    • API String ID: 2289755597-0
                                                                                    • Opcode ID: 244e7fb47d18c7bbf3a37da3c5e02dce215cb24a23166038b5e7351f293ff10d
                                                                                    • Instruction ID: 70d7c2e6c21969e953b010c48f0223e9bceab1d55d16408355fee6de4ff8a5b5
                                                                                    • Opcode Fuzzy Hash: 244e7fb47d18c7bbf3a37da3c5e02dce215cb24a23166038b5e7351f293ff10d
                                                                                    • Instruction Fuzzy Hash: 0141F2B0C00619CFDB24DFA9C98479DBBB5BF48304F2480AAD418AB295DB756989CF90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0D421 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 598 2b0d421-2b0d428 599 2b0d3e4-2b0d3f4 DuplicateHandle 598->599 600 2b0d42a-2b0d54e 598->600 601 2b0d3f6-2b0d3fc 599->601 602 2b0d3fd-2b0d41a 599->602 601->602
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B0D326,?,?,?,?,?), ref: 02B0D3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: 28631e963391db8a91b2a241909658b339502089d643d394f902da3902f7f150
                                                                                    • Instruction ID: c89e2dc84822a7dbb3656ba7ee440782180a894b4561238704fe4479cd89ce17
                                                                                    • Opcode Fuzzy Hash: 28631e963391db8a91b2a241909658b339502089d643d394f902da3902f7f150
                                                                                    • Instruction Fuzzy Hash: 8F315A74A513818FF7009FA4F446B693FAAF788310F11852AF9128B7D4CEB84D95CB61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0A8B8 Relevance: 1.6, APIs: 1, Instructions: 79libraryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 617 2b0a8b8-2b0a8c0 619 2b0a8c2-2b0a8d7 617->619 620 2b0a8ec-2b0a920 617->620 621 2b0b308-2b0b348 619->621 620->621 623 2b0b350-2b0b37f LoadLibraryExW 621->623 624 2b0b34a-2b0b34d 621->624 626 2b0b381-2b0b387 623->626 627 2b0b388-2b0b3a5 623->627 624->623 626->627
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B0B161,00000800,00000000,00000000), ref: 02B0B372
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad
                                                                                    • String ID:
                                                                                    • API String ID: 1029625771-0
                                                                                    • Opcode ID: 8181fb67f7d25a2e6a1ccf1b95069b30c01014bf2d02fdda6cb97868a2bea0c4
                                                                                    • Instruction ID: e1c5bf5e7894bd436afa1bcf77fc54e9f6d57ba7d3ad968ef0b9a5f447eab773
                                                                                    • Opcode Fuzzy Hash: 8181fb67f7d25a2e6a1ccf1b95069b30c01014bf2d02fdda6cb97868a2bea0c4
                                                                                    • Instruction Fuzzy Hash: 9631EEB68043888FDB11DFA9C894BDEBFF4EF49314F05809AD494A7251C3749644CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467278 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 630 7467278-74672ce 632 74672d0-74672dc 630->632 633 74672de-746731d WriteProcessMemory 630->633 632->633 635 7467326-7467356 633->635 636 746731f-7467325 633->636 636->635
                                                                                    APIs
                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07467310
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3559483778-0
                                                                                    • Opcode ID: 0241f36448d50ce7f9702b69ae7ca33b8cc1180de063933ab87675565b70a295
                                                                                    • Instruction ID: 8fb2b21916c2af84661f6d139e0bf7c9fdfda1ff346704a61c8b1d2db3f80bd3
                                                                                    • Opcode Fuzzy Hash: 0241f36448d50ce7f9702b69ae7ca33b8cc1180de063933ab87675565b70a295
                                                                                    • Instruction Fuzzy Hash: 3E2126B19003599FCB10CFA9C885BEEBBF1FF88314F10842AE959A7250D7789945CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467280 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 640 7467280-74672ce 642 74672d0-74672dc 640->642 643 74672de-746731d WriteProcessMemory 640->643 642->643 645 7467326-7467356 643->645 646 746731f-7467325 643->646 646->645
                                                                                    APIs
                                                                                    • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07467310
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3559483778-0
                                                                                    • Opcode ID: 1b517a3b9846a0b33e52273a4feda648f90831158a58c6831e962006331c475e
                                                                                    • Instruction ID: 8b650924d8552e0682bd5f097470800291a06e99157a1c5964761141a4e45d27
                                                                                    • Opcode Fuzzy Hash: 1b517a3b9846a0b33e52273a4feda648f90831158a58c6831e962006331c475e
                                                                                    • Instruction Fuzzy Hash: EF2136B1900359DFCB10CFA9C885BEEBBF5FF48314F10842AE959A7250C7789944CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467369 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 656 7467369-74673fd ReadProcessMemory 659 7467406-7467436 656->659 660 74673ff-7467405 656->660 660->659
                                                                                    APIs
                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 074673F0
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessRead
                                                                                    • String ID:
                                                                                    • API String ID: 1726664587-0
                                                                                    • Opcode ID: cc1dced351e7b2fca52ef1cf0491868621803989b28915591017b353e18c2667
                                                                                    • Instruction ID: f6e3eaf61f50eec3603fce09db50c8483290bf13228cc4a6628673f396d6f4ee
                                                                                    • Opcode Fuzzy Hash: cc1dced351e7b2fca52ef1cf0491868621803989b28915591017b353e18c2667
                                                                                    • Instruction Fuzzy Hash: 952125B1D002599FCB10DFA9C985AEEFBF1FF48324F10842EE959A7250C7389945CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0CA00 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 650 2b0ca00-2b0d3f4 DuplicateHandle 652 2b0d3f6-2b0d3fc 650->652 653 2b0d3fd-2b0d41a 650->653 652->653
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B0D326,?,?,?,?,?), ref: 02B0D3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: 356400163cd4a1c3474a931354a6aee60c3ba0519192d16d7f7f91679e398527
                                                                                    • Instruction ID: 3c880e6c1988eea3a34616e693783b59c10b1c1b1518dcf6afdcf1a317c1dc81
                                                                                    • Opcode Fuzzy Hash: 356400163cd4a1c3474a931354a6aee60c3ba0519192d16d7f7f91679e398527
                                                                                    • Instruction Fuzzy Hash: DF2103B59002099FDB10CF9AD584AEEBFF8FB48310F10805AE914A3350C374A940CFA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 074670E2 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 664 74670e2-7467133 666 7467135-7467141 664->666 667 7467143-7467173 Wow64SetThreadContext 664->667 666->667 669 7467175-746717b 667->669 670 746717c-74671ac 667->670 669->670
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07467166
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: c8521782335f3524a0cdb9fd89180990e57583a1878083e86e2a778f6e13422a
                                                                                    • Instruction ID: 029db1c245a7f2fc6bdee4d09b4ba6084b526ced24d63ce13a32078b8026da40
                                                                                    • Opcode Fuzzy Hash: c8521782335f3524a0cdb9fd89180990e57583a1878083e86e2a778f6e13422a
                                                                                    • Instruction Fuzzy Hash: CF2107B1D002098FDB10DFAAC4857EEBBF5AF89324F14842AD459A7341CB789985CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467370 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 074673F0
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MemoryProcessRead
                                                                                    • String ID:
                                                                                    • API String ID: 1726664587-0
                                                                                    • Opcode ID: 8c7875951260abfb04222ff35bce435092681423f114afaa7b42dc7aca788223
                                                                                    • Instruction ID: ce24ed599d6e4644ade0000eab1faa0ce3d497553705cb7854bc6aef105a9ec6
                                                                                    • Opcode Fuzzy Hash: 8c7875951260abfb04222ff35bce435092681423f114afaa7b42dc7aca788223
                                                                                    • Instruction Fuzzy Hash: 402139B1C003599FCB10DFAAC844AEEFBF5FF48310F10842AE559A7250C7389944CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 074670E8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07467166
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: f71581df58c8416f4e8078a86b953f069d47c99ca3f26f1032ee0b669908b383
                                                                                    • Instruction ID: 1f83bb9faa686548b78011e5fc8ab77ea7ea80ba0f9e7f176839a622e0e00673
                                                                                    • Opcode Fuzzy Hash: f71581df58c8416f4e8078a86b953f069d47c99ca3f26f1032ee0b669908b383
                                                                                    • Instruction Fuzzy Hash: 522118B19003098FDB10DFAAC4857EEBBF4EF49324F14842AD559A7341CB789945CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0D358 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B0D326,?,?,?,?,?), ref: 02B0D3E7
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: DuplicateHandle
                                                                                    • String ID:
                                                                                    • API String ID: 3793708945-0
                                                                                    • Opcode ID: 6410f2f7ef749a9b440f55249a237d38b837d96356bb8ca12a0d84a4488124f2
                                                                                    • Instruction ID: 5ad4c7758577350ca309624ad1d39d8cdd0069cbbade6b6bec74dc32f0b8c398
                                                                                    • Opcode Fuzzy Hash: 6410f2f7ef749a9b440f55249a237d38b837d96356bb8ca12a0d84a4488124f2
                                                                                    • Instruction Fuzzy Hash: 4B21E0B59002199FDB11CFA9D984AEEBFF5EB48324F14845AE958B3350D378AA50CF60
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 074671B8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0746722E
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: 91120513f72625a276096f73e9bf2b4a9fd2a0d0f3ab4f53b014aa8831eae565
                                                                                    • Instruction ID: 62fa7e48da0b177e4d513d180a1e19e059b942ab0a5dcfa9869dca425947462f
                                                                                    • Opcode Fuzzy Hash: 91120513f72625a276096f73e9bf2b4a9fd2a0d0f3ab4f53b014aa8831eae565
                                                                                    • Instruction Fuzzy Hash: 6B116AB19002499FCB20CFA9C845BEFBFF5EF88324F208419E555A7250C7759945CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0A8D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B0B161,00000800,00000000,00000000), ref: 02B0B372
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad
                                                                                    • String ID:
                                                                                    • API String ID: 1029625771-0
                                                                                    • Opcode ID: 2d424e9cc0f122333f6f30e478e06e6022b22f0c8c32e6d96542c58306192cc4
                                                                                    • Instruction ID: 2e33544df435ecf082a64ad8d34460c818a2b6e7417ad9f2c92d6937044ff919
                                                                                    • Opcode Fuzzy Hash: 2d424e9cc0f122333f6f30e478e06e6022b22f0c8c32e6d96542c58306192cc4
                                                                                    • Instruction Fuzzy Hash: CB1123B69003488FCB20CF9AC584AEEFFF4EB58314F10846EE819A7250C375A944CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 074671C0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0746722E
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: a31a24c4eeb35d55d513ad1f67ffe82efb8aa986280a347b6caf8d07ebc97d83
                                                                                    • Instruction ID: 3573053479a9121571d6cc844eee1dc1dcbca047d9882c866ec27b3e6fe0b907
                                                                                    • Opcode Fuzzy Hash: a31a24c4eeb35d55d513ad1f67ffe82efb8aa986280a347b6caf8d07ebc97d83
                                                                                    • Instruction Fuzzy Hash: 0C1137B19002499FCB10DFAAC844BEFBFF5EF88324F10841AE559A7250C775A944CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B0B300 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B0B161,00000800,00000000,00000000), ref: 02B0B372
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad
                                                                                    • String ID:
                                                                                    • API String ID: 1029625771-0
                                                                                    • Opcode ID: 6f41c948373de3a45f5789345316e7331e9b31fa312db0b2d4a8d9af8d120d63
                                                                                    • Instruction ID: e9320327c7d1477c1014316145f67321813bc581f6daf649774905fc308e1a39
                                                                                    • Opcode Fuzzy Hash: 6f41c948373de3a45f5789345316e7331e9b31fa312db0b2d4a8d9af8d120d63
                                                                                    • Instruction Fuzzy Hash: 841112B69003098FDB10CFAAC584AEEFBF4EB48324F14846AD459A7250C379A545CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467030 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ResumeThread.KERNELBASE(?), ref: 0746709A
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ResumeThread
                                                                                    • String ID:
                                                                                    • API String ID: 947044025-0
                                                                                    • Opcode ID: 51aca7a77c8fa5aa3ede37c8d09031eabd7c3fdc139aa5c0ac4f55809dbd68e2
                                                                                    • Instruction ID: 382cafb0f217f06bff8380719a723ccdf3d73e72574ea8f87c55ad08b5510b80
                                                                                    • Opcode Fuzzy Hash: 51aca7a77c8fa5aa3ede37c8d09031eabd7c3fdc139aa5c0ac4f55809dbd68e2
                                                                                    • Instruction Fuzzy Hash: 191158B1D002488FCB20DFAAC8457EEFBF5AB88324F20841AC459A7250CB75A945CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02B09898 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02B0AEAC), ref: 02B0B0E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1715167347.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2b00000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: HandleModule
                                                                                    • String ID:
                                                                                    • API String ID: 4139908857-0
                                                                                    • Opcode ID: 4a0fed06c3c3430a02f75b8ea4ef4d48d84bd34e527fbb97d4c4b7b81a98561e
                                                                                    • Instruction ID: 7711c3a2b648833985cccbcd4ed8a81d071d2d1e4ddec76a37221a31dbbb2fa9
                                                                                    • Opcode Fuzzy Hash: 4a0fed06c3c3430a02f75b8ea4ef4d48d84bd34e527fbb97d4c4b7b81a98561e
                                                                                    • Instruction Fuzzy Hash: A21120B19003098BCB20CF9AC484A9EFBF4EB88314F10846AD469B7250D375A544CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07467038 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ResumeThread.KERNELBASE(?), ref: 0746709A
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: ResumeThread
                                                                                    • String ID:
                                                                                    • API String ID: 947044025-0
                                                                                    • Opcode ID: 809df2a644b3401619cc48e739f40fe62fc97925847ea5997182451c4f219407
                                                                                    • Instruction ID: 8b260483318c8d3511656373bae6c8675784248b8734e6856a7698b0684d0bc4
                                                                                    • Opcode Fuzzy Hash: 809df2a644b3401619cc48e739f40fe62fc97925847ea5997182451c4f219407
                                                                                    • Instruction Fuzzy Hash: BD1128B19002498BCB20DFAAC8457EEFBF4AB88324F20841AD559A7250CB75A944CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 07468360 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0746AF7D
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost
                                                                                    • String ID:
                                                                                    • API String ID: 410705778-0
                                                                                    • Opcode ID: e4e9fb3ed02b685c2699de6539b2ef34b2f5b72ae5d4952becb08bf17e06d5dd
                                                                                    • Instruction ID: c104a523d2bf8660b3e9bdbe233ab920664ead9d4626e62688448b08da299a6a
                                                                                    • Opcode Fuzzy Hash: e4e9fb3ed02b685c2699de6539b2ef34b2f5b72ae5d4952becb08bf17e06d5dd
                                                                                    • Instruction Fuzzy Hash: D11125B59007489FCB10DF89D448BDEBBF8EB48310F10845AE558B7210C375A940CFA2
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 0746AF18 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PostMessageW.USER32(?,00000010,00000000,?), ref: 0746AF7D
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1723431374.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_7460000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: MessagePost
                                                                                    • String ID:
                                                                                    • API String ID: 410705778-0
                                                                                    • Opcode ID: 77652282736389afc0db493fe8027dbbc45875656ce49b5723d23c97d303117f
                                                                                    • Instruction ID: 1a4fe5000e02d31b560e1fbbfd197ac2a1364083b3d91ae88d18f7e17692f8d5
                                                                                    • Opcode Fuzzy Hash: 77652282736389afc0db493fe8027dbbc45875656ce49b5723d23c97d303117f
                                                                                    • Instruction Fuzzy Hash: BB11F5B59003499FDB10DF99D489BEEBBF4EB58320F10841AD458A7210C375A945CFA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A2D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714825629.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a2d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f5607522c126281becbfc16a67a524ba5ff46792e8f6ed1c70b3dc342bd1df08
                                                                                    • Instruction ID: f3f62811e8b3140ba668c51efea1757a80fb5b81475979e0ea58e23bf99f49a5
                                                                                    • Opcode Fuzzy Hash: f5607522c126281becbfc16a67a524ba5ff46792e8f6ed1c70b3dc342bd1df08
                                                                                    • Instruction Fuzzy Hash: 35212571504640DFDB05DF18D9C0B26BFA9FB88318F20C569E8094B257C776D45ACAA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A2D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714825629.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a2d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4f93e446db04bd73fe99f52038cbdc5130b18897b00da291b714823b73002ec3
                                                                                    • Instruction ID: c5c5c4b3b6268185761fc84a72e54b3608fffdf5db3006e545359251220f0241
                                                                                    • Opcode Fuzzy Hash: 4f93e446db04bd73fe99f52038cbdc5130b18897b00da291b714823b73002ec3
                                                                                    • Instruction Fuzzy Hash: 94212571504604DFDB09DF18DAC4B26BF65FB98324F20C169E90A4F257C736E45ACAA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A3D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714898888.0000000002A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A3D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a3d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b265f2a464e5f45c6586f2c8b6fd055223cc538c57574e1a50f6c50f4d36cb60
                                                                                    • Instruction ID: 78fcae80d90f3c10080fe56adf148b68e087db41d9a024d13718b663819edd9b
                                                                                    • Opcode Fuzzy Hash: b265f2a464e5f45c6586f2c8b6fd055223cc538c57574e1a50f6c50f4d36cb60
                                                                                    • Instruction Fuzzy Hash: 16210471504600EFDB06DF94D9C0B26FBA5FB88314F20C66DF8494B256CB36D44ACA61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A3D01C Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714898888.0000000002A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A3D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a3d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a4ccf3643d009b23410a8b1f3358b1547dd8e0f9584650fe8266e1c962d4e1b3
                                                                                    • Instruction ID: b8d938245e2060cd39fa2055de39c6ffb7cdf3fea852c071a20281aa9cd1e999
                                                                                    • Opcode Fuzzy Hash: a4ccf3643d009b23410a8b1f3358b1547dd8e0f9584650fe8266e1c962d4e1b3
                                                                                    • Instruction Fuzzy Hash: A8214270604600DFCB12DF24D9C0B26BFA5FB85B14F20C569E80A4B256CB3AC807CA61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A3D007 Relevance: .1, Instructions: 61COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714898888.0000000002A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A3D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a3d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 3088c0ec5e7e9046fbc3d1eb5a71f5d8d818eeabbcf8559fea00e8da29ec0afa
                                                                                    • Instruction ID: 6e2822b3219d76d1fab1395af70c877b5fee92916fb0c62cf8d722d703b989a4
                                                                                    • Opcode Fuzzy Hash: 3088c0ec5e7e9046fbc3d1eb5a71f5d8d818eeabbcf8559fea00e8da29ec0afa
                                                                                    • Instruction Fuzzy Hash: E4216A755097808FCB02CF24D994715BF71EB46214F28C5DAD8898B2A7C33A980ACB62
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A2D4BF Relevance: .1, Instructions: 56COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714825629.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a2d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction ID: b22ec0bdf577430c003e13604620a38b21f1158a879b7290baf04515307484b6
                                                                                    • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction Fuzzy Hash: E711D376504680CFDB16CF14D5C4B16BF71FB84318F24C6A9D8494B657C336D45ACBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A2D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714825629.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a2d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction ID: e4a3b1515cd078ad360c61919b6bbcfc2a86b7358dd8e15c823f9fb0393dddbd
                                                                                    • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                    • Instruction Fuzzy Hash: D111E172404680CFDB06CF04D9C4B16BF72FB94324F24C2A9D8090B257C33AE45ACBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02A3D1CF Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000B.00000002.1714898888.0000000002A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A3D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_11_2_2a3d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction ID: ba765785dfe505a708f2159e73ff1cf88d808ef655a133907516bbfd9e0ed701
                                                                                    • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction Fuzzy Hash: 2A11BB75504680DFCB02CF50C5C4B15FBA1FB84218F24C6AAE8494B296C73AD40ACB61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Execution Graph

                                                                                    Execution Coverage:13%
                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                    Signature Coverage:0%
                                                                                    Total number of Nodes:31
                                                                                    Total number of Limit Nodes:4
                                                                                    execution_graph 23847 2ef0848 23849 2ef084e 23847->23849 23848 2ef091b 23849->23848 23851 2ef1382 23849->23851 23852 2ef138b 23851->23852 23853 2ef1480 23852->23853 23857 2ef7eb0 23852->23857 23864 2ef7d40 23852->23864 23868 2ef7d98 23852->23868 23853->23849 23858 2ef7eba 23857->23858 23859 2ef7ed4 23858->23859 23872 6c5fa08 23858->23872 23876 6c5fa18 23858->23876 23860 2ef7f1a 23859->23860 23880 2eff557 23859->23880 23860->23852 23866 2ef7d98 23864->23866 23865 2ef7f1a 23865->23852 23866->23865 23867 2eff557 GlobalMemoryStatusEx 23866->23867 23867->23865 23870 2ef7dae 23868->23870 23869 2ef7f1a 23869->23852 23870->23869 23871 2eff557 GlobalMemoryStatusEx 23870->23871 23871->23869 23874 6c5fa18 23872->23874 23873 6c5fc42 23873->23859 23874->23873 23875 6c5fc59 GlobalMemoryStatusEx 23874->23875 23875->23874 23878 6c5fa2d 23876->23878 23877 6c5fc42 23877->23859 23878->23877 23879 6c5fc59 GlobalMemoryStatusEx 23878->23879 23879->23878 23881 2eff562 23880->23881 23883 6c5fa08 GlobalMemoryStatusEx 23881->23883 23884 6c5fa18 GlobalMemoryStatusEx 23881->23884 23882 2eff569 23882->23860 23883->23882 23884->23882

                                                                                    Executed Functions

                                                                                    Function 06C53040 Relevance: 8.0, Strings: 6, Instructions: 545COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 126 6c53040-6c53061 127 6c53063-6c53066 126->127 128 6c5308c-6c5308f 127->128 129 6c53068-6c53087 127->129 130 6c53095-6c530b4 128->130 131 6c53830-6c53832 128->131 129->128 139 6c530b6-6c530b9 130->139 140 6c530cd-6c530d7 130->140 133 6c53834 131->133 134 6c53839-6c5383c 131->134 133->134 134->127 135 6c53842-6c5384b 134->135 139->140 141 6c530bb-6c530cb 139->141 144 6c530dd-6c530ec 140->144 141->144 252 6c530ee call 6c53860 144->252 253 6c530ee call 6c53858 144->253 145 6c530f3-6c530f8 146 6c53105-6c533e2 145->146 147 6c530fa-6c53100 145->147 168 6c53822-6c5382f 146->168 169 6c533e8-6c53497 146->169 147->135 178 6c534c0 169->178 179 6c53499-6c534be 169->179 180 6c534c9-6c534dc 178->180 179->180 183 6c534e2-6c53504 180->183 184 6c53809-6c53815 180->184 183->184 187 6c5350a-6c53514 183->187 184->169 185 6c5381b 184->185 185->168 187->184 188 6c5351a-6c53525 187->188 188->184 189 6c5352b-6c53601 188->189 201 6c53603-6c53605 189->201 202 6c5360f-6c5363f 189->202 201->202 206 6c53641-6c53643 202->206 207 6c5364d-6c53659 202->207 206->207 208 6c536b9-6c536bd 207->208 209 6c5365b-6c5365f 207->209 210 6c536c3-6c536ff 208->210 211 6c537fa-6c53803 208->211 209->208 212 6c53661-6c5368b 209->212 222 6c53701-6c53703 210->222 223 6c5370d-6c5371b 210->223 211->184 211->189 219 6c5368d-6c5368f 212->219 220 6c53699-6c536b6 212->220 219->220 220->208 222->223 226 6c53732-6c5373d 223->226 227 6c5371d-6c53728 223->227 230 6c53755-6c53766 226->230 231 6c5373f-6c53745 226->231 227->226 232 6c5372a 227->232 236 6c5377e-6c5378a 230->236 237 6c53768-6c5376e 230->237 233 6c53747 231->233 234 6c53749-6c5374b 231->234 232->226 233->230 234->230 241 6c537a2-6c537f3 236->241 242 6c5378c-6c53792 236->242 238 6c53770 237->238 239 6c53772-6c53774 237->239 238->236 239->236 241->211 243 6c53794 242->243 244 6c53796-6c53798 242->244 243->241 244->241 252->145 253->145
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2392861976
                                                                                    • Opcode ID: 52673a2f7d01c2ba2086a0dae45bfa7cc3e5db1191be3fc36bde2931b842e166
                                                                                    • Instruction ID: 59d5382ff0ac4a494ccabc3ee64baa01cf06a9d7a6ba871a0c41afe64b9577bf
                                                                                    • Opcode Fuzzy Hash: 52673a2f7d01c2ba2086a0dae45bfa7cc3e5db1191be3fc36bde2931b842e166
                                                                                    • Instruction Fuzzy Hash: 36322031E1075ACFCB54EF75C89459DB7B2BF89300F11C6AAD409AB224EF709A85CB91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C57D58 Relevance: 3.0, Strings: 2, Instructions: 473COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1020 6c57d58-6c57d76 1021 6c57d78-6c57d7b 1020->1021 1022 6c57d92-6c57d95 1021->1022 1023 6c57d7d-6c57d8b 1021->1023 1024 6c57d97-6c57da1 1022->1024 1025 6c57da2-6c57da5 1022->1025 1029 6c57d8d 1023->1029 1030 6c57dfe-6c57e14 1023->1030 1027 6c57da7-6c57dc1 1025->1027 1028 6c57dc6-6c57dc9 1025->1028 1027->1028 1031 6c57dec-6c57dee 1028->1031 1032 6c57dcb-6c57de7 1028->1032 1029->1022 1038 6c5802f-6c58039 1030->1038 1039 6c57e1a-6c57e23 1030->1039 1033 6c57df5-6c57df8 1031->1033 1034 6c57df0 1031->1034 1032->1031 1033->1021 1033->1030 1034->1033 1042 6c57e29-6c57e46 1039->1042 1043 6c5803a-6c5806f 1039->1043 1052 6c5801c-6c58029 1042->1052 1053 6c57e4c-6c57e74 1042->1053 1046 6c58071-6c58074 1043->1046 1047 6c58127-6c5812a 1046->1047 1048 6c5807a-6c58086 1046->1048 1050 6c58356-6c58359 1047->1050 1051 6c58130-6c5813f 1047->1051 1054 6c58091-6c58093 1048->1054 1055 6c5837c-6c5837e 1050->1055 1056 6c5835b-6c58377 1050->1056 1068 6c58141-6c5815c 1051->1068 1069 6c5815e-6c58199 1051->1069 1052->1038 1052->1039 1053->1052 1074 6c57e7a-6c57e83 1053->1074 1059 6c58095-6c5809b 1054->1059 1060 6c580ab-6c580b2 1054->1060 1057 6c58385-6c58388 1055->1057 1058 6c58380 1055->1058 1056->1055 1057->1046 1063 6c5838e-6c58397 1057->1063 1058->1057 1064 6c5809d 1059->1064 1065 6c5809f-6c580a1 1059->1065 1066 6c580b4-6c580c1 1060->1066 1067 6c580c3 1060->1067 1064->1060 1065->1060 1072 6c580c8-6c580ca 1066->1072 1067->1072 1068->1069 1079 6c5819f-6c581b0 1069->1079 1080 6c5832a-6c58340 1069->1080 1075 6c580e1-6c5811a 1072->1075 1076 6c580cc-6c580cf 1072->1076 1074->1043 1081 6c57e89-6c57ea5 1074->1081 1075->1051 1100 6c5811c-6c58126 1075->1100 1076->1063 1089 6c58315-6c58324 1079->1089 1090 6c581b6-6c581d3 1079->1090 1080->1050 1091 6c57eab-6c57ed5 1081->1091 1092 6c5800a-6c58016 1081->1092 1089->1079 1089->1080 1090->1089 1101 6c581d9-6c582cf call 6c56580 1090->1101 1104 6c58000-6c58005 1091->1104 1105 6c57edb-6c57f03 1091->1105 1092->1052 1092->1074 1153 6c582d1-6c582db 1101->1153 1154 6c582dd 1101->1154 1104->1092 1105->1104 1111 6c57f09-6c57f37 1105->1111 1111->1104 1117 6c57f3d-6c57f46 1111->1117 1117->1104 1118 6c57f4c-6c57f7e 1117->1118 1126 6c57f80-6c57f84 1118->1126 1127 6c57f89-6c57fa5 1118->1127 1126->1104 1128 6c57f86 1126->1128 1127->1092 1129 6c57fa7-6c57ffe call 6c56580 1127->1129 1128->1127 1129->1092 1155 6c582e2-6c582e4 1153->1155 1154->1155 1155->1089 1156 6c582e6-6c582eb 1155->1156 1157 6c582ed-6c582f7 1156->1157 1158 6c582f9 1156->1158 1159 6c582fe-6c58300 1157->1159 1158->1159 1159->1089 1160 6c58302-6c5830e 1159->1160 1160->1089
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q
                                                                                    • API String ID: 0-355816377
                                                                                    • Opcode ID: 8ae55c513cd003d6d8d4f02dd5f4dbfdded42745c0fb289a9e3457d7d4317862
                                                                                    • Instruction ID: 7e7ec4bb8733c51abcf360a764bf28b3dfd3a481b4e09c27ba657bd5e3b492e8
                                                                                    • Opcode Fuzzy Hash: 8ae55c513cd003d6d8d4f02dd5f4dbfdded42745c0fb289a9e3457d7d4317862
                                                                                    • Instruction Fuzzy Hash: 5902AE30B012199FDB54EF68D990B6EB7A2FF84300F158569D80ADB394DB31ED82CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C565D0 Relevance: .8, Instructions: 819COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 826a677a00f028678f0b0c87a015cf3d1607b92c51f50b170d798e55870952bf
                                                                                    • Instruction ID: 824b14486447ec3fdc0efe2d17d74e53e1736559c12f7081036f2f4e411b6d28
                                                                                    • Opcode Fuzzy Hash: 826a677a00f028678f0b0c87a015cf3d1607b92c51f50b170d798e55870952bf
                                                                                    • Instruction Fuzzy Hash: 4162C034B002048FDB54EB69D994BADB7F2EF84314F558469E806DB3A4DB31ED82CB94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C55578 Relevance: .6, Instructions: 603COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 88eefe462bd50c91af48c64a086335ac9a6799ebe27e6021f4b789fbb3bb5735
                                                                                    • Instruction ID: 9c5c74be24cec75f26057f4b442325b3a5a59575b1e2660b833114cc01aff459
                                                                                    • Opcode Fuzzy Hash: 88eefe462bd50c91af48c64a086335ac9a6799ebe27e6021f4b789fbb3bb5735
                                                                                    • Instruction Fuzzy Hash: 4D22E435E002058FDF60DB64C8906AEBBF2EF49320F51846AD855EB395DB31DD82CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5B20A Relevance: .6, Instructions: 566COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: daeaf929cf0da60216c24bc5b7e5915466469058e7a3726cb5545c917c6d6f8d
                                                                                    • Instruction ID: bdb5be0e0ab70e017d91149ccf89facd131a9d5f508811c5c891bc7b24ea2fdb
                                                                                    • Opcode Fuzzy Hash: daeaf929cf0da60216c24bc5b7e5915466469058e7a3726cb5545c917c6d6f8d
                                                                                    • Instruction Fuzzy Hash: D5226430E102098FDF64DB68D9A07AEBBB2FB45310F218829E805EB395DB35DDC58B55
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5ACA8 Relevance: 10.4, Strings: 8, Instructions: 393COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 0 6c5aca8-6c5acc6 1 6c5acc8-6c5accb 0->1 2 6c5acd5-6c5acd8 1->2 3 6c5accd-6c5acd2 1->3 4 6c5acfb-6c5acfe 2->4 5 6c5acda-6c5acf6 2->5 3->2 6 6c5ad00-6c5ad04 4->6 7 6c5ad0f-6c5ad12 4->7 5->4 11 6c5aed4-6c5aede 6->11 12 6c5ad0a 6->12 8 6c5ad14-6c5ad27 7->8 9 6c5ad2c-6c5ad2f 7->9 8->9 13 6c5aec5-6c5aece 9->13 14 6c5ad35-6c5ad38 9->14 12->7 13->11 19 6c5ad64-6c5ad6d 13->19 16 6c5ad4c-6c5ad4f 14->16 17 6c5ad3a-6c5ad47 14->17 20 6c5ad51-6c5ad5a 16->20 21 6c5ad5f-6c5ad62 16->21 17->16 22 6c5ad73-6c5ad77 19->22 23 6c5aedf-6c5af16 19->23 20->21 21->19 25 6c5ad7c-6c5ad7e 21->25 22->25 31 6c5af18-6c5af1b 23->31 27 6c5ad85-6c5ad88 25->27 28 6c5ad80 25->28 27->1 29 6c5ad8e-6c5adb2 27->29 28->27 43 6c5aec2 29->43 44 6c5adb8-6c5adc7 29->44 33 6c5b184-6c5b187 31->33 34 6c5af21-6c5af5c 31->34 35 6c5b194-6c5b197 33->35 36 6c5b189-6c5b193 33->36 41 6c5af62-6c5af6e 34->41 42 6c5b14f-6c5b162 34->42 39 6c5b199-6c5b1b5 35->39 40 6c5b1ba-6c5b1bd 35->40 39->40 45 6c5b1bf-6c5b1c3 40->45 46 6c5b1ce-6c5b1d1 40->46 56 6c5af70-6c5af89 41->56 57 6c5af8e-6c5afd2 41->57 49 6c5b164 42->49 43->13 61 6c5addf-6c5ae1a call 6c56580 44->61 62 6c5adc9-6c5adcf 44->62 45->34 51 6c5b1c9 45->51 47 6c5b1e0-6c5b1e2 46->47 48 6c5b1d3 call 6c5b20a 46->48 53 6c5b1e4 47->53 54 6c5b1e9-6c5b1ec 47->54 58 6c5b1d9-6c5b1db 48->58 60 6c5b165 49->60 51->46 53->54 54->31 59 6c5b1f2-6c5b1fc 54->59 56->49 77 6c5afd4-6c5afe6 57->77 78 6c5afee-6c5b02d 57->78 58->47 60->60 79 6c5ae32-6c5ae49 61->79 80 6c5ae1c-6c5ae22 61->80 64 6c5add1 62->64 65 6c5add3-6c5add5 62->65 64->61 65->61 77->78 86 6c5b114-6c5b129 78->86 87 6c5b033-6c5b10e call 6c56580 78->87 92 6c5ae61-6c5ae72 79->92 93 6c5ae4b-6c5ae51 79->93 81 6c5ae24 80->81 82 6c5ae26-6c5ae28 80->82 81->79 82->79 86->42 87->86 99 6c5ae74-6c5ae7a 92->99 100 6c5ae8a-6c5aebb 92->100 95 6c5ae55-6c5ae57 93->95 96 6c5ae53 93->96 95->92 96->92 102 6c5ae7c 99->102 103 6c5ae7e-6c5ae80 99->103 100->43 102->100 103->100
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-3823777903
                                                                                    • Opcode ID: 7ccc8c2a7d3a7b18a0865b0611662ab818a0d461bdbab4c6adfaf77755bf69bf
                                                                                    • Instruction ID: c6a82e42297448af83ba49420c19709a11b8039222efcb07b09d2c3970b13a23
                                                                                    • Opcode Fuzzy Hash: 7ccc8c2a7d3a7b18a0865b0611662ab818a0d461bdbab4c6adfaf77755bf69bf
                                                                                    • Instruction Fuzzy Hash: 31E17030E102098FDB55EFA9D8906AEB7B2EF84300F218629D809DB355DB70DD86CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5B630 Relevance: 8.0, Strings: 6, Instructions: 468COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 254 6c5b630-6c5b650 255 6c5b652-6c5b655 254->255 256 6c5b657-6c5b65a 255->256 257 6c5b669-6c5b66c 255->257 259 6c5b664-6c5b667 256->259 260 6c5b65c-6c5b65f 256->260 258 6c5b671-6c5b674 257->258 261 6c5b686-6c5b689 258->261 262 6c5b676-6c5b681 258->262 259->257 259->258 260->259 263 6c5b6ac-6c5b6af 261->263 264 6c5b68b-6c5b68f 261->264 262->261 263->257 268 6c5b6b1-6c5b6b4 263->268 266 6c5b695-6c5b6a5 264->266 267 6c5b9c8-6c5b9fe 264->267 266->257 280 6c5b6a7 266->280 279 6c5ba00-6c5ba03 267->279 269 6c5b6b6-6c5b6ba 268->269 270 6c5b6db-6c5b6de 268->270 269->267 275 6c5b6c0-6c5b6d0 269->275 271 6c5b6e0-6c5b6e7 270->271 272 6c5b6f2-6c5b6f5 270->272 276 6c5b6ed 271->276 277 6c5b8cc-6c5b8d2 271->277 272->257 278 6c5b6fb-6c5b6fe 272->278 289 6c5b6d6 275->289 290 6c5b8dc-6c5b8e0 275->290 276->272 282 6c5b8d7-6c5b8da 277->282 283 6c5b700-6c5b705 278->283 284 6c5b708-6c5b70b 278->284 285 6c5ba05-6c5ba21 279->285 286 6c5ba26-6c5ba29 279->286 280->263 282->290 291 6c5b901-6c5b904 282->291 283->284 292 6c5b722-6c5b725 284->292 293 6c5b70d-6c5b711 284->293 285->286 287 6c5bc95-6c5bc97 286->287 288 6c5ba2f-6c5ba57 286->288 301 6c5bc9e-6c5bca1 287->301 302 6c5bc99 287->302 347 6c5ba61-6c5baa5 288->347 348 6c5ba59-6c5ba5c 288->348 289->270 290->267 294 6c5b8e6-6c5b8f6 290->294 296 6c5b906-6c5b90a 291->296 297 6c5b91b-6c5b91e 291->297 299 6c5b727-6c5b730 292->299 300 6c5b73b-6c5b73e 292->300 293->267 295 6c5b717-6c5b71d 293->295 294->264 324 6c5b8fc 294->324 295->292 296->267 307 6c5b910-6c5b916 296->307 310 6c5b920-6c5b929 297->310 311 6c5b93b-6c5b93e 297->311 308 6c5b736 299->308 309 6c5b87f-6c5b888 299->309 303 6c5b740-6c5b746 300->303 304 6c5b74b-6c5b74e 300->304 301->279 305 6c5bca7-6c5bcb0 301->305 302->301 303->304 304->299 313 6c5b750-6c5b753 304->313 307->297 308->300 309->267 317 6c5b88e-6c5b895 309->317 310->267 312 6c5b92f-6c5b936 310->312 314 6c5b960-6c5b963 311->314 315 6c5b940-6c5b95b 311->315 312->311 319 6c5b755-6c5b771 313->319 320 6c5b776-6c5b779 313->320 322 6c5b965-6c5b96b 314->322 323 6c5b970-6c5b973 314->323 315->314 325 6c5b89a-6c5b89d 317->325 319->320 327 6c5b7cb-6c5b7ce 320->327 328 6c5b77b-6c5b7c6 call 6c56580 320->328 322->323 329 6c5b985-6c5b988 323->329 330 6c5b975 323->330 324->291 331 6c5b8b4-6c5b8b7 325->331 332 6c5b89f-6c5b8a3 325->332 338 6c5b7d0-6c5b7e5 327->338 339 6c5b80c-6c5b80f 327->339 328->327 340 6c5b992-6c5b995 329->340 341 6c5b98a-6c5b98f 329->341 350 6c5b97d-6c5b980 330->350 334 6c5b8c7-6c5b8ca 331->334 335 6c5b8b9-6c5b8c2 331->335 332->267 333 6c5b8a9-6c5b8af 332->333 333->331 334->277 334->282 335->334 338->267 363 6c5b7eb-6c5b807 338->363 342 6c5b811-6c5b826 339->342 343 6c5b84e-6c5b851 339->343 344 6c5b997-6c5b9a0 340->344 345 6c5b9ab-6c5b9ad 340->345 341->340 342->267 365 6c5b82c-6c5b849 342->365 343->344 354 6c5b857-6c5b85a 343->354 344->310 351 6c5b9a6 344->351 352 6c5b9b4-6c5b9b7 345->352 353 6c5b9af 345->353 374 6c5baab-6c5bab4 347->374 375 6c5bc8a-6c5bc94 347->375 348->305 350->329 351->345 352->255 359 6c5b9bd-6c5b9c7 352->359 353->352 360 6c5b867-6c5b86a 354->360 361 6c5b85c-6c5b862 354->361 366 6c5b86c-6c5b875 360->366 367 6c5b87a-6c5b87d 360->367 361->360 363->339 365->343 366->367 367->309 367->325 376 6c5bc80-6c5bc85 374->376 377 6c5baba-6c5bb26 call 6c56580 374->377 376->375 388 6c5bc20-6c5bc35 377->388 389 6c5bb2c-6c5bb31 377->389 388->376 391 6c5bb33-6c5bb39 389->391 392 6c5bb4d 389->392 394 6c5bb3f-6c5bb41 391->394 395 6c5bb3b-6c5bb3d 391->395 393 6c5bb4f-6c5bb55 392->393 396 6c5bb57-6c5bb5d 393->396 397 6c5bb6a-6c5bb77 393->397 398 6c5bb4b 394->398 395->398 399 6c5bb63 396->399 400 6c5bc0b-6c5bc1a 396->400 405 6c5bb8f-6c5bb9c 397->405 406 6c5bb79-6c5bb7f 397->406 398->393 399->397 401 6c5bbd2-6c5bbdf 399->401 402 6c5bb9e-6c5bbab 399->402 400->388 400->389 413 6c5bbf7-6c5bc04 401->413 414 6c5bbe1-6c5bbe7 401->414 411 6c5bbc3-6c5bbd0 402->411 412 6c5bbad-6c5bbb3 402->412 405->400 408 6c5bb81 406->408 409 6c5bb83-6c5bb85 406->409 408->405 409->405 411->400 416 6c5bbb5 412->416 417 6c5bbb7-6c5bbb9 412->417 413->400 418 6c5bbe9 414->418 419 6c5bbeb-6c5bbed 414->419 416->411 417->411 418->413 419->413
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2392861976
                                                                                    • Opcode ID: 66454a01eec29b8c6030916acd506a562c51b2de0f032326ae36aefa326629b5
                                                                                    • Instruction ID: 427e8dbdfbc84925ca3155d7e5a0114981b2f36de120f84c4a234e2f51a81931
                                                                                    • Opcode Fuzzy Hash: 66454a01eec29b8c6030916acd506a562c51b2de0f032326ae36aefa326629b5
                                                                                    • Instruction Fuzzy Hash: 9E026230E002098FDBA4DF68D9A06ADBBB2FF45310F11896AD805DB355DB31ED85CB99
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C59120 Relevance: 5.2, Strings: 4, Instructions: 231COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 422 6c59120-6c59145 423 6c59147-6c5914a 422->423 424 6c59170-6c59173 423->424 425 6c5914c-6c5916b 423->425 426 6c59a33-6c59a35 424->426 427 6c59179-6c5918e 424->427 425->424 430 6c59a37 426->430 431 6c59a3c-6c59a3f 426->431 435 6c591a6-6c591bc 427->435 436 6c59190-6c59195 427->436 430->431 431->423 432 6c59a45-6c59a4f 431->432 443 6c591c7-6c591c9 435->443 437 6c59196 436->437 438 6c5920c-6c59252 436->438 440 6c59197-6c59198 437->440 441 6c5919a-6c5919c 437->441 455 6c59254-6c59277 438->455 456 6c5927e-6c5929a 438->456 440->435 441->435 445 6c591e1-6c5920b 443->445 446 6c591cb-6c591d1 443->446 445->438 447 6c591d5-6c591d7 446->447 448 6c591d3 446->448 447->445 448->445 455->456 461 6c592c6-6c592e1 456->461 462 6c5929c-6c592bf 456->462 467 6c592e3-6c59305 461->467 468 6c5930c-6c59327 461->468 462->461 467->468 473 6c59352-6c5935c 468->473 474 6c59329-6c5934b 468->474 475 6c5936c-6c593e6 473->475 476 6c5935e-6c59367 473->476 474->473 482 6c59433-6c59448 475->482 483 6c593e8-6c59406 475->483 476->432 482->426 487 6c59422-6c59431 483->487 488 6c59408-6c59417 483->488 487->482 487->483 488->487
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: 38a5ac238f6d933682370bca5d7fcf087c526b51b0a9ea5f8286f9dabee971c2
                                                                                    • Instruction ID: 0c21ac255163c6cf6cca4276f2be4a07b9c9930c0eee1c971ee113d5b6ffde0b
                                                                                    • Opcode Fuzzy Hash: 38a5ac238f6d933682370bca5d7fcf087c526b51b0a9ea5f8286f9dabee971c2
                                                                                    • Instruction Fuzzy Hash: D8913030F0021A9FDB94DB65DD507AFB3F6AF84204F1084A9C80DEB354EA70DD868B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5CF20 Relevance: 4.6, Strings: 3, Instructions: 800COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 491 6c5cf20-6c5cf3b 493 6c5cf3d-6c5cf40 491->493 494 6c5cf42-6c5cf84 493->494 495 6c5cf89-6c5cf8c 493->495 494->495 496 6c5cfd5-6c5cfd8 495->496 497 6c5cf8e-6c5cfd0 495->497 499 6c5cfe7-6c5cfea 496->499 500 6c5cfda-6c5cfdc 496->500 497->496 503 6c5d033-6c5d036 499->503 504 6c5cfec-6c5cffb 499->504 501 6c5d2c7-6c5d2d0 500->501 502 6c5cfe2 500->502 509 6c5d2d2-6c5d2d7 501->509 510 6c5d2df-6c5d2eb 501->510 502->499 506 6c5d040-6c5d043 503->506 507 6c5d038-6c5d03d 503->507 511 6c5cffd-6c5d002 504->511 512 6c5d00a-6c5d016 504->512 516 6c5d045-6c5d087 506->516 517 6c5d08c-6c5d08f 506->517 507->506 509->510 518 6c5d2f1-6c5d305 510->518 519 6c5d3fc-6c5d401 510->519 511->512 513 6c5d93d-6c5d976 512->513 514 6c5d01c-6c5d02e 512->514 531 6c5d978-6c5d97b 513->531 514->503 516->517 520 6c5d091-6c5d0d3 517->520 521 6c5d0d8-6c5d0db 517->521 535 6c5d409 518->535 537 6c5d30b-6c5d31d 518->537 519->535 520->521 528 6c5d0dd-6c5d0f9 521->528 529 6c5d0fe-6c5d101 521->529 528->529 533 6c5d103-6c5d145 529->533 534 6c5d14a-6c5d14d 529->534 541 6c5d97d call 6c5da95 531->541 542 6c5d98a-6c5d98d 531->542 533->534 538 6c5d153-6c5d156 534->538 539 6c5d40c-6c5d418 534->539 535->539 555 6c5d341-6c5d343 537->555 556 6c5d31f-6c5d325 537->556 545 6c5d173-6c5d176 538->545 546 6c5d158-6c5d16e 538->546 548 6c5d25c-6c5d26b 539->548 549 6c5d41e-6c5d70b 539->549 563 6c5d983-6c5d985 541->563 552 6c5d9b0-6c5d9b3 542->552 553 6c5d98f-6c5d9ab 542->553 557 6c5d1bf-6c5d1c2 545->557 558 6c5d178-6c5d1ba 545->558 546->545 560 6c5d26d-6c5d272 548->560 561 6c5d27a-6c5d286 548->561 704 6c5d711-6c5d717 549->704 705 6c5d932-6c5d93c 549->705 565 6c5d9b5-6c5d9e1 552->565 566 6c5d9e6-6c5d9e8 552->566 553->552 577 6c5d34d-6c5d359 555->577 570 6c5d327 556->570 571 6c5d329-6c5d335 556->571 575 6c5d1c4-6c5d206 557->575 576 6c5d20b-6c5d20e 557->576 558->557 560->561 561->513 574 6c5d28c-6c5d29e 561->574 563->542 565->566 567 6c5d9ef-6c5d9f2 566->567 568 6c5d9ea 566->568 567->531 580 6c5d9f4-6c5da03 567->580 568->567 581 6c5d337-6c5d33f 570->581 571->581 590 6c5d2a3-6c5d2a6 574->590 575->576 584 6c5d257-6c5d25a 576->584 585 6c5d210-6c5d252 576->585 600 6c5d367 577->600 601 6c5d35b-6c5d365 577->601 605 6c5da05-6c5da68 call 6c56580 580->605 606 6c5da6a-6c5da7f 580->606 581->577 584->548 584->590 585->584 603 6c5d2b5-6c5d2b7 590->603 604 6c5d2a8-6c5d2aa 590->604 608 6c5d36c-6c5d36e 600->608 601->608 611 6c5d2be-6c5d2c1 603->611 612 6c5d2b9 603->612 604->535 610 6c5d2b0 604->610 605->606 608->535 616 6c5d374-6c5d390 call 6c56580 608->616 610->603 611->493 611->501 612->611 636 6c5d392-6c5d397 616->636 637 6c5d39f-6c5d3ab 616->637 636->637 637->519 640 6c5d3ad-6c5d3fa 637->640 640->535 706 6c5d726-6c5d72f 704->706 707 6c5d719-6c5d71e 704->707 706->513 708 6c5d735-6c5d748 706->708 707->706 710 6c5d922-6c5d92c 708->710 711 6c5d74e-6c5d754 708->711 710->704 710->705 712 6c5d756-6c5d75b 711->712 713 6c5d763-6c5d76c 711->713 712->713 713->513 714 6c5d772-6c5d793 713->714 717 6c5d795-6c5d79a 714->717 718 6c5d7a2-6c5d7ab 714->718 717->718 718->513 719 6c5d7b1-6c5d7ce 718->719 719->710 722 6c5d7d4-6c5d7da 719->722 722->513 723 6c5d7e0-6c5d7f9 722->723 725 6c5d915-6c5d91c 723->725 726 6c5d7ff-6c5d826 723->726 725->710 725->722 726->513 729 6c5d82c-6c5d836 726->729 729->513 730 6c5d83c-6c5d853 729->730 732 6c5d855-6c5d860 730->732 733 6c5d862-6c5d87d 730->733 732->733 733->725 738 6c5d883-6c5d89c call 6c56580 733->738 742 6c5d89e-6c5d8a3 738->742 743 6c5d8ab-6c5d8b4 738->743 742->743 743->513 744 6c5d8ba-6c5d90e 743->744 744->725
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q
                                                                                    • API String ID: 0-831282457
                                                                                    • Opcode ID: 6004ae8b0dd887ae78b4ebf85441daefe71e0ed4f9243f48369c33304069e2ea
                                                                                    • Instruction ID: a15c17446e7a8163bd39340b6d783bb24e1153323599ee6e8cf2416c453eac66
                                                                                    • Opcode Fuzzy Hash: 6004ae8b0dd887ae78b4ebf85441daefe71e0ed4f9243f48369c33304069e2ea
                                                                                    • Instruction Fuzzy Hash: 55623F30A0020A9FCB55EB68D9A0A5EB7B2FF84304F258569D4059F369DB71ED86CBC4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C54B50 Relevance: 3.9, Strings: 3, Instructions: 186COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 752 6c54b50-6c54b74 753 6c54b76-6c54b79 752->753 754 6c54b7b-6c54b95 753->754 755 6c54b9a-6c54b9d 753->755 754->755 756 6c54ba3-6c54c9b 755->756 757 6c5527c-6c5527e 755->757 775 6c54ca1-6c54cee call 6c553f8 756->775 776 6c54d1e-6c54d25 756->776 759 6c55285-6c55288 757->759 760 6c55280 757->760 759->753 762 6c5528e-6c5529b 759->762 760->759 789 6c54cf4-6c54d10 775->789 777 6c54da9-6c54db2 776->777 778 6c54d2b-6c54d9b 776->778 777->762 795 6c54da6 778->795 796 6c54d9d 778->796 793 6c54d12 789->793 794 6c54d1b-6c54d1c 789->794 793->794 794->776 795->777 796->795
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: fcq$XPcq$\Ocq
                                                                                    • API String ID: 0-3575482020
                                                                                    • Opcode ID: 4e16ae09acff545d31e58e897e55a34f57bace04539b7c1eb6d90d44997e76c5
                                                                                    • Instruction ID: 9c42e7594c7a7548a943abc05e667cade1321a8a032be3ee114a30bb61c2d8a2
                                                                                    • Opcode Fuzzy Hash: 4e16ae09acff545d31e58e897e55a34f57bace04539b7c1eb6d90d44997e76c5
                                                                                    • Instruction Fuzzy Hash: 70616030F102089FEB549FA9C854BAEBBF7FB88700F208429D509AB395DB754D458F95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5910F Relevance: 2.7, Strings: 2, Instructions: 186COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1395 6c5910f-6c59118 1397 6c5917a-6c5918e 1395->1397 1398 6c5911a-6c59145 1395->1398 1404 6c591a6-6c591bc 1397->1404 1405 6c59190-6c59195 1397->1405 1400 6c59147-6c5914a 1398->1400 1402 6c59170-6c59173 1400->1402 1403 6c5914c-6c5916b 1400->1403 1406 6c59a33-6c59a35 1402->1406 1407 6c59179 1402->1407 1403->1402 1418 6c591c7-6c591c9 1404->1418 1408 6c59196 1405->1408 1409 6c5920c-6c59252 1405->1409 1412 6c59a37 1406->1412 1413 6c59a3c-6c59a3f 1406->1413 1407->1397 1414 6c59197-6c59198 1408->1414 1415 6c5919a-6c5919c 1408->1415 1431 6c59254-6c59277 1409->1431 1432 6c5927e-6c5929a 1409->1432 1412->1413 1413->1400 1417 6c59a45-6c59a4f 1413->1417 1414->1404 1415->1404 1421 6c591e1-6c5920b 1418->1421 1422 6c591cb-6c591d1 1418->1422 1421->1409 1423 6c591d5-6c591d7 1422->1423 1424 6c591d3 1422->1424 1423->1421 1424->1421 1431->1432 1437 6c592c6-6c592e1 1432->1437 1438 6c5929c-6c592bf 1432->1438 1443 6c592e3-6c59305 1437->1443 1444 6c5930c-6c59327 1437->1444 1438->1437 1443->1444 1449 6c59352-6c5935c 1444->1449 1450 6c59329-6c5934b 1444->1450 1451 6c5936c-6c593e6 1449->1451 1452 6c5935e-6c59367 1449->1452 1450->1449 1458 6c59433-6c59448 1451->1458 1459 6c593e8-6c59406 1451->1459 1452->1417 1458->1406 1463 6c59422-6c59431 1459->1463 1464 6c59408-6c59417 1459->1464 1463->1458 1463->1459 1464->1463
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q
                                                                                    • API String ID: 0-355816377
                                                                                    • Opcode ID: 9013bfc74e316fcb15e2c0ca492c2ffd951789821ce41c615020ee16d70261b0
                                                                                    • Instruction ID: 972d7d0c2b7c42292d3172e945a01d4250bf96009fd6b1c40d34b4816fb0c83f
                                                                                    • Opcode Fuzzy Hash: 9013bfc74e316fcb15e2c0ca492c2ffd951789821ce41c615020ee16d70261b0
                                                                                    • Instruction Fuzzy Hash: 03616330B002599FDB94DB64DD90B6FB7F6EF88244F1484A9D809DB394DA30DD428B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C54B40 Relevance: 2.6, Strings: 2, Instructions: 142COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1467 6c54b40-6c54b74 1469 6c54b76-6c54b79 1467->1469 1470 6c54b7b-6c54b95 1469->1470 1471 6c54b9a-6c54b9d 1469->1471 1470->1471 1472 6c54ba3-6c54c9b 1471->1472 1473 6c5527c-6c5527e 1471->1473 1491 6c54ca1-6c54cee call 6c553f8 1472->1491 1492 6c54d1e-6c54d25 1472->1492 1475 6c55285-6c55288 1473->1475 1476 6c55280 1473->1476 1475->1469 1478 6c5528e-6c5529b 1475->1478 1476->1475 1505 6c54cf4-6c54d10 1491->1505 1493 6c54da9-6c54db2 1492->1493 1494 6c54d2b-6c54d9b 1492->1494 1493->1478 1511 6c54da6 1494->1511 1512 6c54d9d 1494->1512 1509 6c54d12 1505->1509 1510 6c54d1b-6c54d1c 1505->1510 1509->1510 1510->1492 1511->1493 1512->1511
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: fcq$XPcq
                                                                                    • API String ID: 0-936005338
                                                                                    • Opcode ID: cfaa890ec965722cd4eb9603b7ac1040851e7ec85c82c7b7dcd2e48ae26dda2e
                                                                                    • Instruction ID: 64be2d0c6674a0421efd9ba0f681ea578ca87b1d285693fd5d39791cab996635
                                                                                    • Opcode Fuzzy Hash: cfaa890ec965722cd4eb9603b7ac1040851e7ec85c82c7b7dcd2e48ae26dda2e
                                                                                    • Instruction Fuzzy Hash: BC515E30F102089FDB559FB9C854BAEBBF7FB88700F20C529D506AB395DA718C458B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02EFECA8 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1515 2efeca8-2efecc3 1516 2efeced-2efed0c call 2efe420 1515->1516 1517 2efecc5-2efecec 1515->1517 1522 2efed0e-2efed11 1516->1522 1523 2efed12-2efed71 1516->1523 1530 2efed77-2efee04 GlobalMemoryStatusEx 1523->1530 1531 2efed73-2efed76 1523->1531 1535 2efee0d-2efee35 1530->1535 1536 2efee06-2efee0c 1530->1536 1536->1535
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2875539972.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_2ef0000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: eb8871db09e85bb0a8f37f9ddc9b8586cb4ab99d517bc8c17773f54a7dbb48c4
                                                                                    • Instruction ID: 3ed3d25b12e421ebfb3b7a647d3403c1fbd9b9483560fc6cc9463827ddfe6cf6
                                                                                    • Opcode Fuzzy Hash: eb8871db09e85bb0a8f37f9ddc9b8586cb4ab99d517bc8c17773f54a7dbb48c4
                                                                                    • Instruction Fuzzy Hash: B4413472D003499FCB10DFB9D8046EEBBF1AF89310F14856AE504A7251DB34A885CBE1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02EFED90 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1539 2efed90-2efedce 1540 2efedd6-2efee04 GlobalMemoryStatusEx 1539->1540 1541 2efee0d-2efee35 1540->1541 1542 2efee06-2efee0c 1540->1542 1542->1541
                                                                                    APIs
                                                                                    • GlobalMemoryStatusEx.KERNELBASE ref: 02EFEDF7
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2875539972.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_2ef0000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID: GlobalMemoryStatus
                                                                                    • String ID:
                                                                                    • API String ID: 1890195054-0
                                                                                    • Opcode ID: ed0139d5b60d84377cc98a15c2de8d0a50265b6b29a9ec971b63ad9f5308818c
                                                                                    • Instruction ID: 157d79772a9085fc2782a0ea36b4bfdb97c309c12993e48a39a24bebeb6f4eb1
                                                                                    • Opcode Fuzzy Hash: ed0139d5b60d84377cc98a15c2de8d0a50265b6b29a9ec971b63ad9f5308818c
                                                                                    • Instruction Fuzzy Hash: 171120B2C002699BCB10CFAAD544BDEFBF4AF48324F14816AD918B7250D378A940CFE5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5DA95 Relevance: 1.4, Strings: 1, Instructions: 126COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: 093940b8702a1c28306f9a98cf1e71cf57b4abd8c80be4f8441dbe4a78ca6ad2
                                                                                    • Instruction ID: 6ecea2e322f170d7bd7596c0ca832b1d492a9b8b955c8ac57f68b6935d541fde
                                                                                    • Opcode Fuzzy Hash: 093940b8702a1c28306f9a98cf1e71cf57b4abd8c80be4f8441dbe4a78ca6ad2
                                                                                    • Instruction Fuzzy Hash: 4341B230E0030A9FDB61AF65C95469EBBB2FF85300F254529D802E7340DB71A986CB99
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C521BD Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: 4835c4cb72f4d5fb4f0ed72e1dd92974e3576c8542036d32225ae5201200c3d1
                                                                                    • Instruction ID: 77ea3551f2c6cbe2b91017bed6241e8fcfefdbfaed5d69370890b64a2a8584c2
                                                                                    • Opcode Fuzzy Hash: 4835c4cb72f4d5fb4f0ed72e1dd92974e3576c8542036d32225ae5201200c3d1
                                                                                    • Instruction Fuzzy Hash: E1310330B102048FDB599B74C96466E7BE2EF89310F21442CD806DB394DF79CE86CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C521D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: PH^q
                                                                                    • API String ID: 0-2549759414
                                                                                    • Opcode ID: a43400ada3523807348f881dbe045e4f3fcaa99d426146fbffe16656d6593abd
                                                                                    • Instruction ID: 85f4d9738d9828037607fc73f45f9f51536f22c848cd2487beb5b444609f4a33
                                                                                    • Opcode Fuzzy Hash: a43400ada3523807348f881dbe045e4f3fcaa99d426146fbffe16656d6593abd
                                                                                    • Instruction Fuzzy Hash: 8D31AF30B102058FDB59AB74C95866F7BE3AF89310F21442CD806DB394DE79DE86CBA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C52348 Relevance: 1.0, Instructions: 1004COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 783e71581afcee81c53d01756efdd262a786f888310893b178fba5218462330f
                                                                                    • Instruction ID: 36afe7abfa13f7702837dfbea8b06cd94c6fe219f63387f0ebdf1dd556e5434d
                                                                                    • Opcode Fuzzy Hash: 783e71581afcee81c53d01756efdd262a786f888310893b178fba5218462330f
                                                                                    • Instruction Fuzzy Hash: A6925934A002048FDBA4DB68C984A5DB7F2FB44314F5684A9D849EB365DB39EE85CF84
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5C160 Relevance: .6, Instructions: 645COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b39cac1510688e080017181b2f609a404c13a16f489cb8fb4f32507f479e0b05
                                                                                    • Instruction ID: a950c0880dfe50b53f7004220422c7f72116597f7efdd2e5814f690f8b814800
                                                                                    • Opcode Fuzzy Hash: b39cac1510688e080017181b2f609a404c13a16f489cb8fb4f32507f479e0b05
                                                                                    • Instruction Fuzzy Hash: BC328F34B003099FDB54EF68DC90AAEB7B2EB88314F118429D905E7395DB30ED86CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C561D0 Relevance: .2, Instructions: 229COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d0d335492f42e304c813afa2e6d2f69c7adc9d4773b58dce7e279bed410a6d4e
                                                                                    • Instruction ID: 591a890ba0c931e821348bd8a0abfe76e9884a8e59206c6fceeb84fd9fd91267
                                                                                    • Opcode Fuzzy Hash: d0d335492f42e304c813afa2e6d2f69c7adc9d4773b58dce7e279bed410a6d4e
                                                                                    • Instruction Fuzzy Hash: A461BF71F001114FCB50AA7ECC88A6FEAD7AFC4620B56443AD80EDB364EE65DD4287D6
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C545A0 Relevance: .2, Instructions: 224COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 839c3c06dab82bfba0b7097a56e93f0fb6ec5ec8f96e0e8e2c541b0e6cb9bdc1
                                                                                    • Instruction ID: 481d8d7c807080c059187401b93f11ed93036e01477dd93ed5460088b6d0a284
                                                                                    • Opcode Fuzzy Hash: 839c3c06dab82bfba0b7097a56e93f0fb6ec5ec8f96e0e8e2c541b0e6cb9bdc1
                                                                                    • Instruction Fuzzy Hash: 89913B30E102198BDB64DF68C890B9DB7B1FF89300F21C59AD549AB295DB70AA85CF91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C54281 Relevance: .2, Instructions: 223COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7f1016c93d605dd039d5219785e6fcf9eb03820dc7e3d68d1f7ea487bd73340c
                                                                                    • Instruction ID: 6275cefc1a8531e3f68c93f2b7ba5a9872c34190ca903ed6ca815f73dd93110c
                                                                                    • Opcode Fuzzy Hash: 7f1016c93d605dd039d5219785e6fcf9eb03820dc7e3d68d1f7ea487bd73340c
                                                                                    • Instruction Fuzzy Hash: D9816030B002099FDB58DFB9D95479EB7F2AF89304F118429D80ADB394EB70DD828B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C545B8 Relevance: .2, Instructions: 210COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ec67621c70feb8b3cd4049c0f5b7485ca5f7580edc0c189b3827fa6f82df0afa
                                                                                    • Instruction ID: 2fe9423d7cd954c035bd870866eb825de60227572534dcfe259123df6988fcc3
                                                                                    • Opcode Fuzzy Hash: ec67621c70feb8b3cd4049c0f5b7485ca5f7580edc0c189b3827fa6f82df0afa
                                                                                    • Instruction Fuzzy Hash: E5913C30E102198BDF64DF68C880B9DB7B1FF89300F20C599D549AB395EB70AA85CF91
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5EAE0 Relevance: .2, Instructions: 201COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7113357df565454e3347167052a8aa7628fa499249a0f9ce1cd72ade989d0263
                                                                                    • Instruction ID: cb767ecf70b8b02a3de7e0618c17044cad4e94117e13ba50d0eec3ac3d1096a6
                                                                                    • Opcode Fuzzy Hash: 7113357df565454e3347167052a8aa7628fa499249a0f9ce1cd72ade989d0263
                                                                                    • Instruction Fuzzy Hash: 2B711D30A002099FDB54EFA9D990A9DBBF6FF88300F258469D419EB355DB30E986CB54
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5EAF0 Relevance: .2, Instructions: 201COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7160f0f93d7eab1c30a6d240045b67d83a5ecf8fa9c1e2bdd019d010f29a6bc3
                                                                                    • Instruction ID: 845cb3ea192ef8025676e53bcce102e49eaf8b84b7421fec9f0564abb73fbe7f
                                                                                    • Opcode Fuzzy Hash: 7160f0f93d7eab1c30a6d240045b67d83a5ecf8fa9c1e2bdd019d010f29a6bc3
                                                                                    • Instruction Fuzzy Hash: 45710E30A002099FDB54EFA9D990A9DBBF6FF88300F258469D415EB355DB30ED86CB54
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5FC59 Relevance: .2, Instructions: 176COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: bfda4fcb92e3e7142208ad27759d1d8ddd6e59424f4cab27b54a1821259ca37c
                                                                                    • Instruction ID: 9c5cab532dc9ea261fd4e68946b9ca589bf50c2f32f534528b97d56134d97df9
                                                                                    • Opcode Fuzzy Hash: bfda4fcb92e3e7142208ad27759d1d8ddd6e59424f4cab27b54a1821259ca37c
                                                                                    • Instruction Fuzzy Hash: 7751F331E00109DFDB68AF78E8586ADB7B2EB84315F11887DE926D7350DB319985CF84
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5FA08 Relevance: .2, Instructions: 167COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: be694ded328591c9dc7dadf69fb0fc1bd64dedb6c9b28a9a56ffd448c55e7204
                                                                                    • Instruction ID: 118a4849462299627bc14d93e8f560e0f42f42d5c42f68d3bfc689e779a1d666
                                                                                    • Opcode Fuzzy Hash: be694ded328591c9dc7dadf69fb0fc1bd64dedb6c9b28a9a56ffd448c55e7204
                                                                                    • Instruction Fuzzy Hash: DF51E730B202089FEF686668DD6472F365FD789310F21082ED51AD7399CA69CDC64BE7
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5FA18 Relevance: .2, Instructions: 163COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5b3546dfacb9f64afa9a5ef110a651f4ea4ec2236f8f4fb66ee042980272b363
                                                                                    • Instruction ID: a8b95bffc69fb0f47de1ebc68892da3871519843fb79f4ba1a5065fb52cd4a84
                                                                                    • Opcode Fuzzy Hash: 5b3546dfacb9f64afa9a5ef110a651f4ea4ec2236f8f4fb66ee042980272b363
                                                                                    • Instruction Fuzzy Hash: A751C830B202089BEF686668DD6472F365FD789310F21442ED51AD3398CA69CDC54BE7
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C553F8 Relevance: .1, Instructions: 134COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: bfadeadd12304f63f63d6a582b800b481540012a4581e1c59d99d047d3742f92
                                                                                    • Instruction ID: 4b391d2641f0b7774b3c74a76f911fc86a151271dc75b278a2e2eb5180f618e4
                                                                                    • Opcode Fuzzy Hash: bfadeadd12304f63f63d6a582b800b481540012a4581e1c59d99d047d3742f92
                                                                                    • Instruction Fuzzy Hash: CB419D71E006098FCF70CEA9DC80BAFFBB2EB84310F51492AE516D7251D730E9958B95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C55567 Relevance: .1, Instructions: 129COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 8c4122a6ea0a0e5a42bf880b2ff70a6a672b8a1634884d180bbe790542d626f5
                                                                                    • Instruction ID: f716c6a9382f78ba50edce14dcf36dce1205c05df52cc8a4d49e86fde35212c2
                                                                                    • Opcode Fuzzy Hash: 8c4122a6ea0a0e5a42bf880b2ff70a6a672b8a1634884d180bbe790542d626f5
                                                                                    • Instruction Fuzzy Hash: F641A731E102458FDF60CB69C8C0A7EFBB1EB45310FA2896ED459DB351C634DA81CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C52080 Relevance: .1, Instructions: 99COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e33736b72964a9559a9a0998e9d780cac9680bdcf27d6f4a09bbe12fb20a11bd
                                                                                    • Instruction ID: c673a83482a8b80422cfb4928dc13883fe3d4e2bb5229bb19d88b86ba84558b7
                                                                                    • Opcode Fuzzy Hash: e33736b72964a9559a9a0998e9d780cac9680bdcf27d6f4a09bbe12fb20a11bd
                                                                                    • Instruction Fuzzy Hash: 01317931E00209ABCB55DBA5D854A9FB7F2EF89300F158529E906A7354DB71EE82CB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C52090 Relevance: .1, Instructions: 91COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0692a3514a85ece3251babb7234f1b390320c92eb6330e91d3d5d075df27ec7e
                                                                                    • Instruction ID: d11e3ac23e8855b333aeb5611bcfe8cf054f28dc62d05a071b67949811b94d70
                                                                                    • Opcode Fuzzy Hash: 0692a3514a85ece3251babb7234f1b390320c92eb6330e91d3d5d075df27ec7e
                                                                                    • Instruction Fuzzy Hash: B6315A31E002099BCF55DF65D854A9FB7F2AF89300F118529E906A7354DB71ED82CB50
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53A81 Relevance: .1, Instructions: 82COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 732471704b78033038de51f70901be443da6676c4fb6b41474e32c25fd4ca717
                                                                                    • Instruction ID: 4bee6cb4bb8cf3a280455e5051c1aa56a44108a66a93ca00f91c81c9f4cc4836
                                                                                    • Opcode Fuzzy Hash: 732471704b78033038de51f70901be443da6676c4fb6b41474e32c25fd4ca717
                                                                                    • Instruction Fuzzy Hash: 8221A175F002099FDB40DFA9DC80AAEBBF6EB48750F118029E909E7380E731D941CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53A90 Relevance: .1, Instructions: 78COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: be2891235cf40fe0b60db9d833f68e7230b07922476053251ff5f23feec424a2
                                                                                    • Instruction ID: 875c7e0e6d636662708520f1f609109bc0ecf63e1f61bdbd63328b9550008489
                                                                                    • Opcode Fuzzy Hash: be2891235cf40fe0b60db9d833f68e7230b07922476053251ff5f23feec424a2
                                                                                    • Instruction Fuzzy Hash: F5218E75F002599FDB40DFA9DC90AAEB7F1EB48750F11802AE909E7384E771D941CB98
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C56CE0 Relevance: .1, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d0b4a2481524ea491a1c045d23e085a9ebcfe8f1348d69eacd74d1dfd8a02afa
                                                                                    • Instruction ID: 8cc70bd78b6593376821ae57f63764f1f3c8bfce5b7e40bd9a660167e33f8646
                                                                                    • Opcode Fuzzy Hash: d0b4a2481524ea491a1c045d23e085a9ebcfe8f1348d69eacd74d1dfd8a02afa
                                                                                    • Instruction Fuzzy Hash: 2E21D430B101089FDF54DB69E8506AEB7F7EB84350F61843AE805EB351D7319D828B98
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02D1D044 Relevance: .1, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2874614272.0000000002D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D1D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_2d1d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b8dc60463a0a4034b9410d85af82b34fa15922cea37723cf5c0101de8de8416c
                                                                                    • Instruction ID: 2d818f48c6294f53759e48acae77db9437b68a40c9fb3a34f31b860b56562a97
                                                                                    • Opcode Fuzzy Hash: b8dc60463a0a4034b9410d85af82b34fa15922cea37723cf5c0101de8de8416c
                                                                                    • Instruction Fuzzy Hash: 1A2107B1504204EFDB14DF24E9C4B26BB66FB84314F30C66DE8494B751C736DC46CA61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53BA0 Relevance: .1, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 3d6537b385ae5e6dcd0372c93473b3e8bbff56d5e17d98cb423099f01df022cd
                                                                                    • Instruction ID: 3285c487964d71107cc60784fe35bd1704840cee500ea3f897391d9a72f653bf
                                                                                    • Opcode Fuzzy Hash: 3d6537b385ae5e6dcd0372c93473b3e8bbff56d5e17d98cb423099f01df022cd
                                                                                    • Instruction Fuzzy Hash: ED11A131B042295FDB54A668CC14AAF73EAABC8250F05453AC80EE7344EF64DC428BD5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C541E0 Relevance: .1, Instructions: 55COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 9d2122d57e726d1da5f532082fba06eb9c817b50d70945eb3fbf8f7d5622160e
                                                                                    • Instruction ID: 4ebb9174981d3b2313c10f1749bd459dc1a420433ba556e645a3169895bf9f2c
                                                                                    • Opcode Fuzzy Hash: 9d2122d57e726d1da5f532082fba06eb9c817b50d70945eb3fbf8f7d5622160e
                                                                                    • Instruction Fuzzy Hash: CC01DE30B000101FCB65AABDAC28B1BBAEBCB89714F14C43DE90EC7344DA25CD8243A9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53B8F Relevance: .1, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ad576976edf1d94ac0172b5f548165d2a1d8aa165e9f58eb4034d3b332c90820
                                                                                    • Instruction ID: 9ae5f3d266f9080495df19aae2239a512e49d31692c1c1055025c790c6ac78d4
                                                                                    • Opcode Fuzzy Hash: ad576976edf1d94ac0172b5f548165d2a1d8aa165e9f58eb4034d3b332c90820
                                                                                    • Instruction Fuzzy Hash: FA01A731B142295BDB54A569DC20AEF77AFDBC8250F05413ED90ED7284FF609C4247D6
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53858 Relevance: .1, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: da4e72c6dc63c4e796469620d47d813b9d30dfab92fcc24e921aa81c14c040f7
                                                                                    • Instruction ID: 510ad71b36195bce72605ff970127a7ea08aba2427141c4e3dc2763c99f12097
                                                                                    • Opcode Fuzzy Hash: da4e72c6dc63c4e796469620d47d813b9d30dfab92fcc24e921aa81c14c040f7
                                                                                    • Instruction Fuzzy Hash: E421E2B1D01259AFCB00CF9AD884ACEFBB8FB48310F10812AE918A7240C374A550CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 02D1D03F Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2874614272.0000000002D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D1D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_2d1d000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction ID: c465c259667306c3d892a962ac609b1d9e1e091a974c1a114be5475181ac4db0
                                                                                    • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                                    • Instruction Fuzzy Hash: 6A119D75504284DFDB15CF24D9C4B16BFA2FB88318F24C6AAD8494B756C33AD84ACF62
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5A2D8 Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: be576e1d744444b8ccdb79cf0d7290ac09c9d6cdf3ba576b662e71335e1c439a
                                                                                    • Instruction ID: 5462f7b70caa03ad00d19110bcdad84578b1cf3e6a2e3bf12a9efddf0203fd55
                                                                                    • Opcode Fuzzy Hash: be576e1d744444b8ccdb79cf0d7290ac09c9d6cdf3ba576b662e71335e1c439a
                                                                                    • Instruction Fuzzy Hash: 14018430B001141FD761E67AED61B1E77DADB89714F118439E90EC7355EA11DD424395
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5ED61 Relevance: .1, Instructions: 53COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 69e1d843c40389332959021c3dc984c8a2f560c41e54e4a9ef23e8b6b5180fa5
                                                                                    • Instruction ID: 791dbaac6db740f873007fa8c150581f5ab6c25dbf0443c307fc438281d661ae
                                                                                    • Opcode Fuzzy Hash: 69e1d843c40389332959021c3dc984c8a2f560c41e54e4a9ef23e8b6b5180fa5
                                                                                    • Instruction Fuzzy Hash: F201DF32B105141FCB64AA3D9C50B2F77DBDBC9610F15883DE90EC7344DA21EE424399
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C53860 Relevance: .1, Instructions: 52COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 1b08c9f73905adf3403ad9d17bcb80e93e08745d281beed1457c2a685ad178fc
                                                                                    • Instruction ID: 3ab8e765dbc728e9b36a1f9418e16faa5df07b91af1c3d0b4ebabc91f116859a
                                                                                    • Opcode Fuzzy Hash: 1b08c9f73905adf3403ad9d17bcb80e93e08745d281beed1457c2a685ad178fc
                                                                                    • Instruction Fuzzy Hash: C311B3B5D01259AFCB00DF9AD884ADEFFB4FB49310F10812AE918B7240D375A554CFA5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C541F0 Relevance: .1, Instructions: 51COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 1d366cc10391e48a82a3c328ef7a8df7b05bb65ab454aad25685841b40c739e3
                                                                                    • Instruction ID: 2928bc25bf3b5a271ada65d96f2310d082ab56b699eecb3523a8b0c88e0d6c73
                                                                                    • Opcode Fuzzy Hash: 1d366cc10391e48a82a3c328ef7a8df7b05bb65ab454aad25685841b40c739e3
                                                                                    • Instruction Fuzzy Hash: E8014F31B000201BDB64A5ADAC5472BA6DADBC9710F15C43DE90EC7344DA65DD824799
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5ED70 Relevance: .0, Instructions: 49COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a387c23c8d0bc562313cfb7ffd9f0238eaff1c6fd6402a81ab8eef45233afca8
                                                                                    • Instruction ID: 00f054ce62e5087131887bb07b18effd24b2e95a11e80aa6ae1b390619b5a142
                                                                                    • Opcode Fuzzy Hash: a387c23c8d0bc562313cfb7ffd9f0238eaff1c6fd6402a81ab8eef45233afca8
                                                                                    • Instruction Fuzzy Hash: 4501AD31B104140BCBA0AA2D985072F72DBD7C9610F148839E50EC7344DA21DE424389
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5A2E8 Relevance: .0, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 75fcd010abf45f428cab0910b3185a8498bd7af28d0901de65d6de947aadd304
                                                                                    • Instruction ID: a3d6fcab35694a29568dd4d7fb9ca039edf4feb46d9dcd2a97d5d94a9a86e5d8
                                                                                    • Opcode Fuzzy Hash: 75fcd010abf45f428cab0910b3185a8498bd7af28d0901de65d6de947aadd304
                                                                                    • Instruction Fuzzy Hash: 7E018130B001140FCBA4EABEEC50B2E73DAD789714F10853DE90EC7354EA21DD428789
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C56451 Relevance: .0, Instructions: 26COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b554ea570603d16dba67685b538d6cdc1e92ae0d84d2648dc599774697f58f74
                                                                                    • Instruction ID: 0c8c6f2c4fc1b6a6bd835ac658b6765d728676e3e1af1b87948b2f126d8c5054
                                                                                    • Opcode Fuzzy Hash: b554ea570603d16dba67685b538d6cdc1e92ae0d84d2648dc599774697f58f74
                                                                                    • Instruction Fuzzy Hash: 48E0D8B1D183486BDB50CE75CD1575B7BBDD702214F5245E9D844CB292F336CE818395
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    Function 06C57678 Relevance: 13.0, Strings: 10, Instructions: 468COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2222239885
                                                                                    • Opcode ID: 0ac86fe683499c302588590dc38a122accc108d1d5c25bea61b2ca92619720ad
                                                                                    • Instruction ID: 32e6f0d0f56c21bd0980a585258727a9ee19ce7f601dd2882be8f4cf410a4983
                                                                                    • Opcode Fuzzy Hash: 0ac86fe683499c302588590dc38a122accc108d1d5c25bea61b2ca92619720ad
                                                                                    • Instruction Fuzzy Hash: D2122B30E002198FDB68EF65C954A9EB7F2BF88300F2185A9D509AB354DB309DC6CF95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5A910 Relevance: 10.2, Strings: 8, Instructions: 229COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-3823777903
                                                                                    • Opcode ID: f38571de172046d048d5f386637e08de2811be12f24db6c2a79ec87f517ba139
                                                                                    • Instruction ID: d9a410d2d8ea3a9e45553b66b8b8ff4c3f466c9331d26779f4593bf4071ae7fc
                                                                                    • Opcode Fuzzy Hash: f38571de172046d048d5f386637e08de2811be12f24db6c2a79ec87f517ba139
                                                                                    • Instruction Fuzzy Hash: DA915130E00209DFEBA4EFA6D994B6E77F2AF84300F118629E8059B355DB359D85CF94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C57078 Relevance: 9.2, Strings: 7, Instructions: 405COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-390881366
                                                                                    • Opcode ID: 3c96636e288649e0135f21a843cd8b8bad3541707bd61e0b8af164b55baa5446
                                                                                    • Instruction ID: 2bc314d21c305395f464654ef44a1c0eb8d3198dbada831cec9f77d7b6a07966
                                                                                    • Opcode Fuzzy Hash: 3c96636e288649e0135f21a843cd8b8bad3541707bd61e0b8af164b55baa5446
                                                                                    • Instruction Fuzzy Hash: CBF14F34B40208CFDB55EF69D994A6EB7B3BF84300F218568D8059B3A9DB31DD86CB64
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C583A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: 7e4b08e87f7bfbc341368fb207cb30764ad03efa5f6f9be2931a148770f3b30c
                                                                                    • Instruction ID: 3b71bbafcb40ee2a0eb24f745fc3df7a930d4bff001655b6f4339b15af5888e3
                                                                                    • Opcode Fuzzy Hash: 7e4b08e87f7bfbc341368fb207cb30764ad03efa5f6f9be2931a148770f3b30c
                                                                                    • Instruction Fuzzy Hash: 3DB13D30F012188FDB54EB69D99466EB7B2EF84300F25C829D806DB399DB35DD86CB94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C587C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: LR^q$LR^q$$^q$$^q
                                                                                    • API String ID: 0-2454687669
                                                                                    • Opcode ID: 7c03ad4085dbbe0db6cd47f93eb812ab62c9bd175c3be29080daf9973d4d7b7a
                                                                                    • Instruction ID: 6f3ed7a314a99d518d5426a3ba464fce629eceadc3968c174ef4e2cdfbdb7921
                                                                                    • Opcode Fuzzy Hash: 7c03ad4085dbbe0db6cd47f93eb812ab62c9bd175c3be29080daf9973d4d7b7a
                                                                                    • Instruction Fuzzy Hash: F851E730B012159FDB54EF69D954A6AB7E2FF84300F11856DD8069B3A9DB30EC84CB95
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Function 06C5AC9A Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000E.00000002.2895393584.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_14_2_6c50000_XEWKUH.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $^q$$^q$$^q$$^q
                                                                                    • API String ID: 0-2125118731
                                                                                    • Opcode ID: 0e551ed1ece2676091415bcd3e3ddc167ea5e4a4c8e290013ccb32e5cbca7a9b
                                                                                    • Instruction ID: 72c5058f171ff499c8638bcec5440976f35d69f2cdce40f3a4147086dad90fd6
                                                                                    • Opcode Fuzzy Hash: 0e551ed1ece2676091415bcd3e3ddc167ea5e4a4c8e290013ccb32e5cbca7a9b
                                                                                    • Instruction Fuzzy Hash: D9518330E102089FDFA5EBA5DD9066EB3B2EB88310F118629D8059B355DB31DD81CB94
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%